Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 18:48

General

  • Target
    d03b3b7cbdd297e3d3e6cfd466424c8a_JaffaCakes118.exe
  • Size 277KB
  • Sample240906-xfxdbssgja
  • SHA256 55dfad72753146d3a3e1f28517202b4a1460ca60dd886d48ad68da70f6bfefcc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    11223

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d03b3b7cbdd297e3d3e6cfd466424c8a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d03b3b7cbdd297e3d3e6cfd466424c8a_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:1784
      • C:\Users\Admin\AppData\Local\Temp\d03b3b7cbdd297e3d3e6cfd466424c8a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d03b3b7cbdd297e3d3e6cfd466424c8a_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:824
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3324
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 380
            4⤵
            • Program crash
            PID:3044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3324 -ip 3324
      1⤵
        PID:3620

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 279432656e27c120217f7f74b72d7d6d8e2355026dbb75cc73dadd7c20ee7440
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 a1058f69e5b2faf60b74547e6e9a7dd4991da7d4b986b1f9c9fe858a0a89e707
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c54a76b9efd2d1a55091a6e90905eb974540a7725500401d7ec64216fa31678
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a28ca02a0be962be4d98d73c251639662dc88c621b9e92513c90129aeaa7ef4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2c291ab6a7c7b76bd482dabdb2336d667d269c8558ea378121ec0367769e6ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f727eb78586835ea4369093744db899f7e4b4ecedf1fa6582e7e653347adce69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 832dd6adcd2ade5ed425428a6669360210b3e1a52213ba3efeb3f6ccc4c59f63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9287e5fb0025b8e67de29db5ffe8e2b80679a1e5648b02c4ce4e35cbcca2cec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88adc70a5bc292d81e68b4e27a703521f9c50c0e530e50373afc81bb5ff48ee6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a698f31a280b8272e10b864bfaa261cbf60b2e76fb0efa78f6e3585984bf04f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f68a0e6153751589472d21bd8c8bbd6d4b84f1693be281008128658eff92363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fe23c8becb9b9e0dc0b37a772c276a61d55a07b35d7f3d47e19226a9e41db5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e81538a213540a95bef5f578bc089094e3247bdcd32e1a816ca47426162f04bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a1f47c45b28ab8f79ced56b852d9591c17dca51bbb593f7381bbe5a9d5a2c3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e49e2d39a3572f1748c913e98e762453f8326f79ab51b6b37b9281300c582a55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cf1a7fda7e7144c1d5f8560f64aeb70badf386ed3b0656c7043c27336e55104
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddefbcb4682eee906fc3a950e9d1c7cb9b7cf22dc85c0289d947c7025c1726ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 babd541b614f5190a50fe0d9b921b10a610990fe7ffd69c7c50eea3e56ad8418
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa9c031d859b0b9595e4be92f0879110cac704565d31e0e641a62f6746a0ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee71faac9ae306c64f8583bcfca911a393fcfde863db2b07fa15aa15694053c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69b7d4c86040a09bb23efd2baa891adbeffb75f2de1812e13a1b8e0a89918ebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dcea091f52c3595d90642e90e8c67fa98f546c38da5dc8cd62c7190ef5f5ce6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb0e93f55a1f227e9caf2952f9fdc1288a324e1144dea3a8cd104c9d959fafc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f2bfcabe19765453bf073b3d8720e747057b25553253b6983e605f3412f9576
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 661ea0afaf46f1999510f2df28c6fa516c16c89f18b2f2f0f5ccc1e08bd68cac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62f1dcb45cb166c094e9f654b99560698378c2f46e0a3e33781ee6e43f6d5506
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7120a481cac325ed5fd7b54d291c9fbbcf95916b2ed9d2646b34541ca29879cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eb5d8da25b86038cea025ca77451f6c106a45abbb306f5601bc8c4679a7a2e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fca1030ab55b808e026cc3b367557c037e5b324d25a0803bfcaf574f9d4b5dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 261a73e12380eef8df276f3503e4b68d617fe3b456423190d826d771debe583f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c2d9c22e8b5abce715ac305aa0d476caf015b78d2b807e7428e1f0b93ab3bf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 771aa553aa087aecfe09d513c49debfd332d66b61e3c5785f1fa80fca05098bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73b19f4722669b79550651b030de8f958ec2497871325242033163b3f47dea9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202b51162e0af5982f3223a4c0896e38302b98b2c2b08b0b3fbe82e31df7b16e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 916e7e90954d92565d19e80d7947f436b671690b1e77420c2c8e3b1b7ee3101c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 046df9b12c7d06499a87a0820315ffd9481fddc7037e8910cdc2f60ac073a5c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 076d265d354c4f7b689ab8c8da0a47316e4ebb4f56381e390f500c4497cf29c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 920a8057709a19465ca73c5b05606bcdd1305a6d6566fc12998e2c7232e146a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b085a5f559f8a4c771d356bd12aa59af00dbcee28538234877749b7710ee4b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34700ec4fa6197ee52b9dde3fa90170fa60eb4c4594dda57dee42dfebc006aa0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc1a76e235c580f17f4f0e82e6f27cb9b1d7cc58873578bdbd951ffd46164eec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 247335beb172e211eb71c8a1b7879ad301cf4da30822c47a0a14eba4c536183b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dafb03707fcfb6c51fc588571ca3643bcd9de072ac96e2c08b637d2d6f44ff0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7afcf0794cf69b917e068d833e26e6c3ac9294947afe1edae09a2c03ac366db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ebf600d85dd972ff7be6780f5fcf06b86332fab8326cb1bf4a1517bc7c4e30a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41ee74039845f40bffdcd1278f67b87020a0e46611bc22edaeaf4dfd9a1294bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09d69f3c641d0a442323f912376a90e77c6e29c0df996d6f3d0c543a033e4a08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6fbc6731713a17cc6826e98f0af20c583ce585079000d979cfbf3884e606b9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd4d032501428f8ac8d8db28094b2313c8cc274be353b2c1df8aac8b9eca5291
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acae38454cd6090b6044360ed261ec6174a8f2ebaf5a25505c563d6171138b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72890b83f4036eb9ee5d388cc675be25c384d3bf6d01ad64a31637d8ec2f1574
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cabe7fbb7a78f47ceb1605526977c13d20af25b430ae62a878e56ac52b4a3db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e149f4703bee2683e4e89508f4860524929abdfe6ab9d5af94145e93b98f153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c87998ac63c8135a57ddf6b4f8e203027df7df786106042b6bd7944381ef27be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 675de1442f229c2e996f05d683e134f1851e72e00dacbe427bda64a13b1de660
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6666b9473d862f189450b8e848c55fe0c993dbaf674c39fcd69939d349ce355f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c69a8366dc9628c987957e6c143001e352172e97390e079b97c59fb38abb7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d64279cdb9ee9fbf97b99f7ea40a2f41f2bf85f506d7571b17a397b315fde2fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e46bc6b6c595106c839d8bb40fa020a41e455e9e59f48abea55295803c75614
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 915cae4734b7a8b19d18685162bb300024e5d7e9a19ebfe57a62ec5a008364cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e313684d59a4410c6c2e5323e2fe27c3a5182f70143a648b8049e424349bdbe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b601425c68af03075efc8774f577e54e8b969af102cbc7ad60782b2cc0f7a6de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36e65cdac8ba0ed247bc29d67d2236cd4f6a909de6354ff4d52ac2544bf4d8bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c7414673da73b7d6eafb3eaaa6a9840cd3573abb818a0a392ee2bfd0085cf06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f28870d4e0c83e6e27facc610dbc6fd1b2e4f0926c210263d51b33f849a36bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a4c7b03c7237121c53815a1e372a168c15904583aeb75d40a2d17532d6574d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07f913e90f26e88ea6db986c952f63ae38792116a88d3a20058f2a7f6d4ed2d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06f1600f41cd87dcbe5bf5ae577fcfe089271034b1feed612f85fd4f90a2fba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 271c455c5a3d4140f60b3435bbfe3b186e2627a837be2618cb8076228caf1c00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 061c301440babdd74190b47d0b0527f40bb883da6174caf42bf13df5b2cfdd51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ea9a5ff2f34ee439c53f3d93df201215a97d84caebf654edca9bf23210cd80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 129f18de50fac14d735ff5c5c528babb9d8c465c39227ec2aba99ea29e4382c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 433b8cfeda6c5aff7d5c2e34940a852fcedb40f93768bb9826a98ec84e6b1178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff78c92cd355d57c0750fd89af44220e5cd586f9aaf7213007f0dd46e32a9d87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fa3abccab7c68142be75f04694b5dfc612650cb487c1297c829a1cf12af12f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7210cfd066610ae9bb2488f6186a05e33e016b75b42c4732684bc0e0bef4faa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9378bb17b6588c4ea5c4caeb152650fc631442e363f057a07ed3462c4a82a883
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ecd859b7e461866e1a2227954d60eda2281da471d67f411d06be44459cdf44d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae728cfc80ff98a39e568d38636487f95c25d7913aa1bfc1d9ae06589fdffb41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80526c8418d052481f5e565ab753c010d659fc48f1d5571c7171c078021ec818
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e18d97a0ea85fbeab5461f1bdfd5ca48bd84634e0cc6c5affb464da73155760a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea119b0ab7e54406525f721dab96fd84a5736854880467e45f736d297633acce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458e16a8e3961ce6ec05ca8dc650be275f0aec9129ac737c1d5e391ff76bd49a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e93b68d8f70234c911ab612c622def3ba9a9bbfb6a4cbd3245f6c91afeb11c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 732c012d501d3776f851f0255181cfda096d2544cf61cd241cc2049421561c9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1ca48b36d61d4282d811aff1d7778927dbda41bdcf8c28f3a0b72e6c139a547
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8afdf85366be88607dba0b8514fc6ef8b4c19e168255aabc0d393649f95ec5c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f298d91eae6f5a2ad9d7c358757d299f1e8e13d530bbf627bdc037478418c32f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b0af22b3eed7b2db893c6c3ed4977fd0e0b54e695bad910eeef6439e168bf95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dad1d897a116895a831bd76a7139b845fe9f509cbd6c0341cff8a0a4dfec46e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb6f044e4bfc6ca0eb70a4f4ead84c514c0abb47c94973c497dde824678a9ce6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 548be88c52f2c4ef02a9a5cd7d530cbd33ee65b71a8872510e3acb73ed996ad6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3ab974cd990d180d3d3b9095970993756ba4671b40c38fa8f83c2a9b7e6a8bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3678c93efcc7792dc047479540c756fdc4cec443b2b115665ec04acf9d5f350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b258fab28e0a9b468f39b03cbe332106e75dd2c3d04842ece2d477ac2274ba4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be7f91765472c15a77d799d90a7eb08b3b9c41fe37aa83ac7522e4dcdeb87b0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07fb98d1774c0a83fbb096955b081bbf4fa88c26b8504af5ab62d8ba6cde7e8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd5174ce13390849bd1f9a3fc65467092f476f4c3b434c75212da9ad8f81ca4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 497c8b367c70ce79e243411fdff479a600857fa47de7c261dea318c53ccd7a77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f364c831328a38c9791e27e0fb1c1f5cf61f83a172c555768e20f0c2a0c33b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b090e4c14c5bd9bd013ba3f30e5cdd1fa582faa4bd6308515637ed9efc14d481
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f013c1bc58455774cf900edbc7de383081d2b53bc2339f1538fa04b07554273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18127a061b4f9f2860b9a784caa518b5a893203137092d78a04d7e75539db154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52351b9147e2be96e033dfa3a33a3991e9f9ee5bc74bd6e873394f3e0aa36596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c50fcc47a7549dc06ae77cb2d4ba94f571c9715fdb19477b3cc7149b43df44ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beb79aa31e7da92da5609cbcba92437297701e131584ba07a66a7d1139bff8d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79addc0c3c815a24cbe6df1d1949289f30d5768500a1ff5b0b4034e469b1fb27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0b419c3eb50743a9a53754ef725e334a56cf30fc79c5eebe8241345b12cc455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 482af6a519d4bec97478b436082df22b2fcb5a322835d7d44aba7d314b6fa843
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7464af1c798dafd90c52a8b8c908e8efd71946b72af692789c1274b37d70f2d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 949bbb3157b5d003da4ee45db1ef63090bf85612c91037ec86503355ac9da15f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a82d794e0e563b1f7dc5eade03003a3b4b74a13c0519e3054ad4ae670801b0ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82cf1340b24f9578dfb738dfb95e971241fae4434252ddad8515d0e3c89a7e33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bacce309c3b4b59f34302c9ec540d0769d77bad73a46d9001ee6e46f8177ab93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2db594afc0e0b7686dca210e84a474eceef4cf22518374515364940dce58ee3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 887917c888eae1c3c02d2521ce797cb2f106b40103aecaab63c32a34c0c654a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a29e9ba1bbee9c330d282c9ddcb011e85a903866432531acd1e01feca7037632
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f226ef303298d4697a62d67cd1a956c2f843583312de4d6794419daa50fd551d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c6dab8b4e3ff49343f95d0c803c215059922778b38529475457c3db1816682
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca57879e92f598d3088929d58f0109d19e044b2fcd6ecc5dd36639d47f74cbed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce335d7f20337b5c08d43f15819b05155866d5a44657960d031ed0a467fd99b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b511192d5733f3d54aafb2ebc525c93eed2a705d7c6d943a53dbe8660364287f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a22d429b025ef6140836cccf8719592f6884076a71e37359aeb93a1b7d393ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d30a9a9fe5be6db4235a8d3553c3b9d85b66973b435212f845e1bae2996b450d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05caddfec2ad072532a544b98d6b45848589b42e8cdb9794524cbbfc09c983b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3204acb5cae96bff708fcd067d225a3b654d6874d49c1ffadf4944184321855
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c28b096a1831e504fa5d759facc333129fa11805ba22230f1a098e3068844aff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9cd4241213e7db23f9030ca0627569b5071c7b3214186342204b00964c3bdb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 011214bdedb970c7d950d10f9523cee1ce9ff8435cc8e8c79b78e105fe31b900
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 252b30f23cec13a5b9412e65d08ffd6a335b579fe7eb85a6d33d3928e54a42ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8a5fef267528ad37c6086a4952689aa93aa8ff3f93bc13b12e8cc4d346ce6f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a486b0bd2c785f30457788a4d664293f56bb4603b929d09b4ff127cd0a8bca2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfa2d5ff8592e890784251a3d9ae76bb694f9a64e312d4890777d79b2d66954c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ba73ce5437d4a9c9cd5f0519307304df9c01dee746c24cf924c2d328a925231
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e06317bc8c099da409c37f3acf6ffe9bcf50b433c892453aff9fc11c12a4604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee4948b8f918f558358008fc15c873ca4d3ba1a2faf51f1840c327e7390c49da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686cac1a71945356d39f576a78b9a9acd40597a6a56714cd7db26280519e69d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36c54de6818b86cdae32c85179f9f8d7c812c4b0ace8199e2e3cf4b2c92a2b5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4a1067ff70efa98a455a237028da3359f35c95b0115865e335201d6bd5955a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d767db9359fa0c3c2bfd8b176e1600185a4d5ae8a3348483dddff0a9d9d3faf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bdcd6fc5010a437f3d76d8cc545452cfab4f6b4828c2a7c6a812403950fb885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffb88f170dc1b54125e0b346326289fdbb8650550988f8c64031a41e1a101cbe
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 277KB
            • SHA256 55dfad72753146d3a3e1f28517202b4a1460ca60dd886d48ad68da70f6bfefcc
            • MD5 SHA1 SHA512 SSDEEP

            memory/824-102-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/824-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/824-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/824-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/824-69-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

            memory/824-26-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1008-22-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1008-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1008-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1008-66-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1008-3-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1008-0-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1008-72-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/3324-98-0x0000000000400000-0x0000000000458000-memory.dmp