Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 03:06

General

  • Target
    d58f1bead9158f3665890735cdae9560_JaffaCakes118.exe
  • Size 391KB
  • Sample240909-dlwjfa1ena
  • SHA256 2e5418f772f97f8ff9500a2350b8078d9d249387d2eacc071ed0aed4ffb195c2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • balushi.no-ip.org:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3388
      • C:\Users\Admin\AppData\Local\Temp\d58f1bead9158f3665890735cdae9560_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d58f1bead9158f3665890735cdae9560_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:3156
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4384
          • C:\Users\Admin\AppData\Local\Temp\d58f1bead9158f3665890735cdae9560_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\d58f1bead9158f3665890735cdae9560_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1788
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4300
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 564
                5⤵
                • Program crash
                PID:4852
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4300 -ip 4300
        1⤵
          PID:1392

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 9f5db0a97a01c433d43b86c2560d943dc3f1a142a771b72ee02be2c542126a7f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 90efbe7f91b824fc2d7f9c7acd7be5772defacca68c37f99304642839872ece3
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf587f1bab7458e195d7e2b42f1eb74bf0e1bfff2b2f106b36ab0b74bc637fe8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43544c29e734c658a33896b0d16c51eceaacd3fba56827c916940483e2e0b869
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffc7c7b43e65efeb3389c0376ff23f8b781c2695f647581aa657db35a2c0714d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a805b77c63a710d62b58647c9093995361d3ccfa59d31ebf87634789a5f2b083
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e457072a3b8857eaca3a2279253b6c40ef3a1e2e1b57f3f407fc0ec29f20ad3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7b9e4aaa67536ed0e1e71cf87128e9684d6be6b9a0428f8cff8afdbcf1cac91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6486a9b538c1a498fe1a10a09d68f7af8faf4099e2683a63ceaf9520f2769225
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8145dad1ba5527156686b749148606bb2616250d37d5029a7978645af45b5bf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 038be34a74bd8922e65a6a24836de37eb6600f79ccb16cafe080669181e76b2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3eeff851e63719b8d6949079f758b7bf76b98991c9986376ddae3dd6127f36a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9a587833b032f9fcc1843d606356b049e461a5a27740eb23ecf3ba2be32ec33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5a76d78fce1fb070fe95208bfe361b54f073e87d9e6510caea7c9e8c43f5cbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48477a5555d07ac9986ce7849e9d627420d419121d88401c732871542dcd3bf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 028dc598a0b4a6246a3a01c4daa12dc2552b7cfc4981e13100d80a5ce70604ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a645effa4f509e75ebadb7764b9df5898201040a85666f62aa9300c50cb6fe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8697ff5f7e66e26cb3bea461da355236fa6dd84bbcd0299abcd803ca7b9d136d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17f63365fcba392a64a50ce5b38b8bc2e4f24b711ea126672527bdd20d3ccd5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fb586484b2fe6dbfe7c8b1bd206e09961405df62c591761cbc2e0bbd1418747
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984ab1a00f2363bdf3c3c35f3d77dfd12e37fac7d2ec80d17437a9fe946fbaa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a737ac4e361e3408cdcada2bb78198c78fd3d7f1120d8f352fe72dd07f073745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e001ff3c0debf341090dda3504bf6ea9977f0a2a29e76786ea0601596ca2b703
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eef34e481667b2522add93b0057cdd896a1d1090672d39339f4c1bd24963fe13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 972eda13a97c494534b0d320ceab82498a61f7164f731341e59dffd13fb8fc06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14a232103e4c0fea43c46f14e2abd36b787654dea445bb766ad9e3b6e1376a4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f73ad75d23b419d42875eea104c3170e90d474199a0ae1609d3792fd82415c38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4994ad33b5d74c93503de6c5daaf216072f280e208de838c1f3a73223c550db7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eb040a39608b3298ba921670e949f088444efbc3f3efb30f73d21c3f1e173ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823dbf2a3ad7a28c306b4032fd3cec42641cf41ed8d7cf3db7f36af2d726792b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43cdb0171ee602b8635f50a8b118b0797f75cab04662887585822ae95bf09902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f28d490c067a3671dad7b8619f481287df1d26454fd0520ca3791a542769b141
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38722a7e6ab9ce838e1464108fad96c443a8fc796b784b4c976352bd574b4ac6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02f6be3fb99156c7e82970e23f70caa7d86205fd6ebf3f166ea51a81f15c48d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f02b52e01b262a34fe553d0ba2e0c8251fa28858c5849e7f0b4db5075e9f6b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3168a5c08fcbdea6d91e13e20f4e2eb551091e6ef068129a42e0013163814b2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dc3c47a0b620aba0fded0381eab34114c4bb6ec7040b6fa9243bd36b0be0e65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffcbe329388add3c44ea2618628e484a89ba1d41cf2cd286738f44ce31a5448c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3628b36fe0e10ac82189cf8a26d29a91c3098c83ce07c7d35d60562796c5a5c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fadf9c6c36349d627e0ec4e7b9b1f7489dbfe1f1a1415e3d682ba7ca144fa275
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a57d6e969199808a91d982e78db0701aa725a89b02f4793f5a64e4a1c264e558
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 769a0f8c83f10e546a3f4624176357d73975bda0a71f5109a84ebd5db3ce4ec2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f55dc46e2b5619fbf9498eed44d45362b1158e8ec65a43ff49f23856a1528fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c912a0a59e7df8c9bcf2314e2a96d214509aa78a60c100778b4d89b4fd1c142
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 880b4a4f45f9a6964a2533f5ed4dfaabe1b53466207946abfce3aea710401c1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8aebe84018ead987531689216129a40aff31bf918565ffafc0c56199c2552e39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1e638257b70e20dfd7a605c46c7118b7b88a7703dc9c64092d1582a1bb358a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f39016e12b49349af904e6c0d98067d6f40b93c1f6522532e91c7a88b71f474
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 416be5485c2a3c9eebab2fe91911f8487006103d2dc66d091bfb1f440c21021f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8250794e637dbe89274ce974485d4515aef95a886d16b9a0a2ae84f35e851f95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0c7b0a101e2ee139d983780b1830a400a4b4f3fe8ebc8cbc29a591b30ad7a93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2b7ddf2a81b67fe6ba727127f1de8e9ea1fed39a61db6fb44e05774917f2e39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab42d170a6599da2b668c8dd7428cb8db709b6b775df225f4f3e6f85c3529da8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be480cc415f15e22776c9922d003af58437fdc87f0cc6d16b0f7d848b7316d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1403ed1e6b47513ccc72d188efe3e0c622f1cedf0f1067172afae43178a09432
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31ef350c0ac2a619b7e40dffe9d4680574f1282f99815983d1845746419a95db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a62449ce176a26be30437cd594645dc978eac7ea93063bbe1fb55172a120e3d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a4395063344fe6308e40965b58668e42c64ef4931172b4d31915c07273f3d17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8acd074feb261aacfa0579bd2602be9a037d05db38858c55cb04042bd337c916
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eb8e580528880d3049740ca4681289ffea67ee8897a98d4e176582a17534867
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dffde19bd069a551744fc6718cfaeb7de3b5436ed355a8e3051e90cfaff5bbb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be5e3086a8f53a001c3858c147e7184233539c30ec8522a801d374e749930dfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7508dc761118da6754cac0a66b5d328c25dd9bd8a8d3649bddf1918f147bf1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bdee66d1542bca5d13ea70dc44a3ec3432c2e9072b53fc9438b786a0b333097
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8347135f897fa6fa650ddeb11c2fd135c4e20cfbe0739e63f732b9e5f2957c3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0d518a9f25345e4dd2c3ce842ad80f2501c18166ea542e9b97d663467fa330b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e14dd25cc1e373205a0b20ed4745fbee975c3ff74071f0bbc8a21f9621960f3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 658260fe4f27f10bbf4100c2f23319233d32bdebba3d92936a38b72d7b2f0584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a420354af9d2f58f7e8afc288a5861c904ed8cb2406f1e21059239f39770882d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8a602dfb4218eb19731234fc3fef5704bb73ee8c603229e1290fb86f99cc5ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 017583ff4fe47c5619abb992e931f393dc67c73541c15c02048f404afe17b770
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b524fa19445ca04c5be3fecdf18bd10f4a897d388707581e01d3c216886c036
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7e2ae54b9733266fd6233d2126dcb5e4f85b049e40987255311419d069b58fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6fd5105e6c4732828dc7c913b600a7bd674e17e9ac8afb3a74afdc1afaa12f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e61d946d13f9c775ed53d737aeee86903b4193c804dd324fc8e572af84c2439b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe1100a7f77ee15092986b8914a1ad32ac4c455dba4061024e81ec4e0aa74b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab2f1b1163ddca5706e5a09e326fba3603f5cd6a3630f1001fdaa15a12436433
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3004e34b2bef4c090527bf35a1ab921a8490b7735d708b1353ecf29ebd20fba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 186040da7bf6b8e0b914a5507e08a1ec60e97eaab7f20f67aac4cfce96d76805
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2fddaa31e451a12472ef1d9a69c1caf91bac892a2450ca4850fde6729e22ee5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5787e852e663c0090d74e567aba8d49ea968bdcfd7632d2e0a94e87e6a8796b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9e14de34c16cbc310ec63e6e9a4d0d1e8a2758dcb5ae0737a1264c4692814fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb9686b2ab0129a0b965b420de4c76543f88f1e19584bcfd3cb84e830a3d1eac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c40a82251327e7257f2f730199503c8e2571d70dfb281eea0c09910da1cf0278
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6f813adbadf0d31123eb257efafdd86e7b9e0eaec0126e9dda4b8121201a52c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fc6c09ca8322fc5b9fdf00e00e2d7f92e1d7a12762a6219cb4eee3fac7b4ca1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6462fabf74d5e7c3610ad256c0d7d6a5640af1d357ea69e15b2c94953f0b8a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 256cfa3196c6a0f975d83c21d1d82a1136c3605410c13315e4398762784188a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89a79a377b72e865ae8a54b78141a9ef02f65e7c1afe32c32379358db970088b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d355c20fdaa097ce61454783c976d91d890224ed65fb2bab6f718b134d310e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fee3ab6c7eaab8e87bfa425b801a80cedfbe0bbec1a896d1d98c9dd16dfec94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0de19a0933b494d1f6d4b61772293bbadc7ed8d19b3925e57c43efa9ebffcb64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53bff19b2ea8d76280378a55fe63a8a0493d1316dc6903e1cf0248fd8f076c81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aefe15cd1c9ca30839c2afe9cc6d96e5a50c6228871d032c14b8cfa03f50eaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3065256b12d809755f640bf7075c2a13e818dd17828f67210fe9a4e168991b37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e47551297d35be3c1374d6b5a632b60cf1c1d21b6a7f40b5b4d0bb8773988bfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fe5323ccfd639c3f6ca20d197b87bfb7334fd6011b36bafb95f650d29078ca6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 982bb336c40c2d2ab117d276efc96b75bf743a086e0320d7bb6e2afeaa93faeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3a762d6018e716c14ccf921c020e987cc8b4e95e0aed603a997992951d6fed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25f6cbf091ead3e43dfa6a54a5059daf0a97361005cbe8f5000b5cd87d58059b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecb907546ee6ca899443ebda6135b7830d627de1ef6f266836aeb6dda8b21c50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b68a8da8851658cfcc20a4e6997cd4e802261301b55c6ef7924424183559ff5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da965888c73b00bef8e19030e22ceac95d4b6f3a122813f9e900d0e7941889c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17152147dff4725454b0c8bbab62725a25411cad2f9e83f56dda21b2ea81449c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40ded83948f4a577c04876676d487580acc5a60fe014eaaa5a581957d96077c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f62fb9836d8b78cb290e5c22062ad7004b795347293d16fead44616a00c4d477
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d7e7971aaf1ff3bdaf2c11bd16aef9803b3ab4d770b68c2f726b411dbd7b366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f26308ca0cf360c68ed8d57ce105b86e5d952e1b1c02a1b98cc58fc531154f5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b1d67bf524069ad68b2594001ac9c6d9b36ccf8953710ecfc62ff9a04064586
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8c897856f24beb016262c7168d0592ec4dcadef96a888ef2a4455a44aa99a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfee496727b5ec71dabecc21df32d28eed4275eabb2d9f26956a5a7c110b1698
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 499530dc92f0761d9fd7430278624cd169f64b14f835d4d12fac58c92f776dff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fdf053ab64fc9e6b70211afa6aba10a1a8a2f474c9413f95df7f9ece9cea82a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fba5adc58196f4063f126da338b8a7ac52979f04a11e3ab28395905d9d7df4b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b81d30155e0ed42f1a40e42ee6154e982d5430212268b4be0c2b6e5eb3ff3cf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9481c59485794a5f05c57c953af035c78457e1f0c93766791958f70da3d8b100
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8ab5ba87eb7f6a9421b372da2fbc59ad6f648d7aa642d5e53df1e2bc7349487
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50aad7b383e8d59231124537cd979ea97249775834b13daf8d3aa0c83ea6ce14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0d0992d80303364c21d32b4597bbca40128c185d1438fe90eb06a3b98b4c2d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4e4e65faf388e0aaf31800b3b6569d484378bc9512dbe8939c220ca967f2864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 162e7738d2941b0844c324f675863738b139d5674e7aef80759ef577309c6ba6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcacaa515caa5b0c3767dc20db0817ceb9f43bfee4766259608e6906b3cf9fab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fff903a09520271f5c5c045ddc5c9779e6c7fe3a819f5ab62aa824843c934f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bb8703940033f5d433aa804278e23297ee8325c7247dc69fc09656dc4fb7312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a258d4357069db4f72ec961867228223986aca7ffd03fc663ac345fd08c5403
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b794ecb2eabeb35b2527f96291c6623bfdc4ec507f24a07f0c1aebf89b294d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b61b8a4d5c65ce3525cdb87dab7daab724067e823d65424715e2d8405617d13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a612124c2ee13bdec07ac38881b927522e98dca89a6aef957c074cf9bfb472a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76ca87932c7fbdceddb18c85e77d06c74f418642e64ac5c48e4c5cd35c64c796
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90141a762533591302abb61a51d9a306fe1cb6173ec2b772ca3dd45bd04aa0cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5871cff796fdbcb5111d965ab737501c7b2d55adf8cc5b264a013d75f3d1044
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f30996e8fb3c33a7f445d3ea112ca300f4cae10124f44988deeddbfc81877cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1877f5766eaf9231bca3c3c54757d1c200ea54783fd8feed702e51285af2a00f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41ad3d4070ed1a223eaad73827759aa749c9121945e5e1657d846fb1577d0836
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d38073c7d692c3f9627c906c4f691865d18f9f0b71b2a5fe208e7a9052b61159
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bd0a4d528114733b4eda105f0d698ce133a1230fc0397f320a08f6f929d6485
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0735e819dc7694870d10c85d3fda0dc1409cd46523d521fd0a215855b7fbdc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 208e6455ae8a5ae0d8e2e0695e1725ae2d055b72fa2fa5bc0a47f36adf664cf7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f5a10a76d8de11c0dab7c0e7991f2faf62a5b2115e90c4df9eb4d5f3d82bf2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bf15026bea99672b46259a29e2211ddb78f2f9a057d60620b23390fb45a0b53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 416295a2399d07d9ae772c57ba6d3b11c56434cb236e7b2d6674c136ed41ff77
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 391KB
              • SHA256 2e5418f772f97f8ff9500a2350b8078d9d249387d2eacc071ed0aed4ffb195c2
              • MD5 SHA1 SHA512 SSDEEP

              memory/1788-167-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1788-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3156-162-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3156-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3156-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3156-66-0x0000000003E90000-0x0000000003E91000-memory.dmp

              memory/3156-8-0x00000000013A0000-0x00000000013A1000-memory.dmp

              memory/3156-7-0x00000000012E0000-0x00000000012E1000-memory.dmp

              memory/3224-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3224-63-0x0000000024080000-0x00000000240E2000-memory.dmp