Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 08:16

General

  • Target
    d5efc5f6e466913a2bd2ead2fc913954_JaffaCakes118.exe
  • Size 283KB
  • Sample240909-j6edjs1fjh
  • SHA256 3f57031a93410ead53b085f2eb6ca9164055962eda3a4c4675f8c8e91c6136d9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • azooz8.no-ip.biz:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\d5efc5f6e466913a2bd2ead2fc913954_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d5efc5f6e466913a2bd2ead2fc913954_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1572
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4596
          • C:\Users\Admin\AppData\Local\Temp\d5efc5f6e466913a2bd2ead2fc913954_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\d5efc5f6e466913a2bd2ead2fc913954_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3968
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2748
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 560
                5⤵
                • Program crash
                PID:536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2748 -ip 2748
        1⤵
          PID:3940

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 c325f49dc365d7e68fefb77b4c9b424ec121ed154877f6fa6bdd0927aa9a924f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 3b021e0894fd4f272a4d6e2d516ec879faa8444c7d55baa9946f480bbd9849ac
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dbd4622d4cb659334772f6583996840573cad0e57b02bf08bc39beb2b32e132
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f134062ade61172a57e47c1cafc148829eda5a79ebc26ccf1bd3d8a25cd36289
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5480cb842a3f30afe6ba9db26d226213bf46f0a014d7def3ee63b30356616f62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a506acb9cb13866d3e1ea7da2b51bdf2f173e67edc3f678a45ba7ca0b23c0df8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3acbb9f2b0ceffd0a3a64eeada746080252b4886c3cb589a9b591697fc9dad54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8de802c96e282e135f480909bb78b235811d32c513116bbccd191b636e532f36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c3592a0902f9899e365445384ca024f5abd50caf13e859a6db3deb02e5fe6e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2761dffc486d9704b23e985cad1d89689e38c0d92e98fa56c91d4aa4fb1da269
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d7d1c99050d8156dc4154c9fca14ea06d6981f05cd1c046dbd8e2dc86e3a61d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1515f7f254bf37dc0a2cb219be9dc8aff3d955d82d68b6af419d57af534c0d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eb90dc9849db6a687a09ce132479fc086c416fad9f811869f1808ce81d2db17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89d6771281db2575f35e178aa193927d703581344e2f2437d8f998803d8d7b36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c5546112c0c26dc31a027a835e920fcf980bc8b0159a9b3ccf369df7a4fee9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a7c0c1549ea05d23389ff37d76e50abc11c125d21222e9c0c2a7c7a70a7b48b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4b2b493f4523bc6a116e15dd5f30c3ed6af35276d8393d688adbf52649f989e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e96b8972c4c88e92f3b209a5ace5328b7dbfc684d7428034747ad10bebb4df4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 611ab7b28db545b82415360fb0d178795f4f690da186f91fee0b6c72b4f8d3d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 838f0156c7aa48de9d59fd71e9b7f108cd6cb42de4e3cd93c159cf2e88247d29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5ecaa12ee48e88d447e0d190b9a52bca7c0404a973a8362ce78bfd04fac0f32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c0b9af0ef109c540d0de203c08b38437eb83de8637551d40303c16f42043d9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69304701e254c97185fba86b80f968e83d7429a1fd94a77c5e3771497f165057
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9eb6431f067e5a71078913663ec7035f0d52b3173ccf951f5a0e6b4e1819b11d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98ac518bfec71dbfff1fb6a17da056fc61099e211c13aefb1067be27f428df4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01b483e4504ea8810678b7bb6c5616456f0274a724924648eb6ea07a9a8115cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15ddcae56bc03d3ce3c8f65c271f25ef60764b3b35a47ec58871705ca79adb89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acca780435e95d7d530cf36d5d7bc52ab0f4772fc1809b4d7da92a8e67ad53f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de3750f35d40ec2ef2c1b3012f7be5098fd4216725d14e62043873f49f0d5afb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d136f699103f852894654258f4624afbb5b4e02b103487b7ad49b75205de07ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42b73fb81ad9c80a95015ff833da3e6bdc5c5f502ac6f8c013b563741851f893
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4394a0380d96e7bef874f7e7d52a8fb7224a6440a2ca96cf9eedd8af72265c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a47063938d463762c5b945864d592fea0ebdbfe633216a8b3aa0a29b9b6b813
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af569d4ac5101e689972f49640561544438941e1da72221fb1e0504812bbf96b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f9c92f55d0aeb0f02c2191560b2ac453b6ab446853ad826dcc82cfb3f1dd1bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a97bb5938d09716766df4305a840e8406bf1fef0ccface5f8b555444330e63eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aeff5e1d19d0f3c8aaa1913642f14fb1fd35f51a291380f3ba2a93ab89a3eb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28e14a7e6fca527a5f0554f7638cd1f84ca3640a428241f9d2920e17749ae440
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 105994c1e340131f39ec2cc7133c246c0939d221eabdde1e96d755424a0b03e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69219debb9e5a20b420adc2ed7dfd94a8ad908cbcfac44bbe9c24feb791dee16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2090365c5f20c40356e9f423b76eb577939395506c3e62350dd0da2b42c50d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78c0683ad27f3d472872cb98e5376d142fb9bebd0f4e71e67c111d25094b63a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5326814d7419b9c7fe1de45005827247529f86882412257e72c55f6404f8c9d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c51fc63c77bc9417b8b7b3e06d2df0214946f3413829e6c4241a5bde0374143e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31a33a73ce3a19b745966e6e9963e001da6af28d45bffc740af2fb460d26884f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e3f4d4814b27e78bb21d1b52916168eeabb47dbb096e40e26fe9070d13ae821
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8911d266646504b9086de39fffe876168f2bc346e3adfb48db1f07cba5bcff23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 594c6e36bc36832a58c6ace12494c1a48e0f093a40d5736a566b94e80d0a1e10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97d776faa111aed060657cd414d20c2229db5d522b16449c603ecb2f2e34c7df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e14e97ba7d65286a966f97109c54a15c63783c88274f5fcbad3b7e682b5f8b7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82adbaa1ace1af555096ada4bbadf55a738552085d88bec7b7dcec979f65a68b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ba0373bc8566efbb0db1d81220d74e2b22db3388cad2f6aa3caed3ff475c5f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ed8344c4ccc591cbcf433aaa35ee961e4657ae300c75be8648240042c5ad6fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 189c49c4a043fa9dae67b131185a831ef3433b01a9d73a38677f9930cac7eca9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e376a1b6100ab7cccd3b1011858dd13efba7a18ae78134e51a40d9ae2a888003
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9daee7f63d6ba272f4625ab0cd4203019808d71768a98437c3c3c31a643d3639
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4e35b3928b1fb8968f0da4ccf3be75d2719404912a30bd17b5ce9b686e6954b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b903a241bb21ca0088236d7468983c4297471fb51e1bf5408ce73096cb48d52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0595187f34b295189910424e9e228684118dd52cf2af2841077721b90636d361
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3abe6ad4eaebdd1418e4d9b51edbfd5c0a864b12c76fa19d4a1d4778e405700c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f8f9f167671eeede04c0539e9ceaa419e9b40e017144de6e8130038937141b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd2509b2d171292dbf62ecfe5b6faf9269abdf9968b204e3c191375118ad02f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a1dc3c2c882e55882146e2556d9b8d5d616e110924371232cf49c48dbc8f68f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d572a9d553028121026ed9411d33416cb3603444b9667161707920846d94cc72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cde3770bb1f581ddda966dcb5aef216c9d7c695055ada86c789f8d2056937b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4af047db10dabb994894217e6b5282c55f9b0efa9a188b5e40ce77ed0a05be09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afe1acd37e9909cb37da9939480daa78ed53073f94fbc9a5e89705ec78df0033
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4cc5ee9207cb87c56b111785b3fe9b008698f4a18b1df331ed0bd8ddc48190c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5584afe64bbd739d8ed43ae26991f76b0c58147a3d5e0c53b01b8a9f1fc40535
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20e5aa280bf94df40e2db9c64f16cc13cf1422298f70ccca4b4a9c3730b31ec4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55eef2e1a2709aaee06253a081298515fc8ab4b83fab6cf3b3bdf99ee9389697
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ad3610adb67daf3397e23df07caa41ff037ffcf6049cd14db2d2300d05695bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42a96a7d3c5b88d034184746c6217aaa4ff864960ec2ccb295f76ab297b01a01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61b85b1a9fb9a194098f51cf80dc0b3ff810064ef372c6c480e5802cc42e36ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad661e055b0ea6202226c756cf53f073f62ef7681b70fcecb318bab74e1a543c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f8f9b3a2548053e4ad9a39bd83dd88754246cc086f10da018e5697d3c3eb15c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6aa6a5e60ee8af7338d73c756d331dee7b8ec916e48b74bc6e6d84548a544968
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fa1f0d62eda42f8f3b7b08ddfc5a928a71cc1d43f6a374d4f80860f2e4130f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39af9b9fa52c0b37f9ce4360fa740972a09ff0b3535ae722ac95383b94fa40fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e59a2028d683fb27019c8db103267df65035c5676124038d09d1490b4ffd10fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb94da4c714c58f7f040a06e4005b085e011d5220fdfc46f7e88b4e307dab197
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f8e6d2446915d489e7ec973d8bc69c47850fb064f4b0cda7ac14a1846b6cd4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd95fb955eac577b450db69396cb5566c14e6e4b4747f8321e72e14d95fe3452
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2d1d650748e9b6e79960676ef6c97dd018943918abafc1770a12517f87dcfad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58ea8df97722a99da456ceb4d3c91e62cb933c7e70cdd07b732189bdbef4c2ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b231a11b34b18a7153246cd11aa1beac54e103a4649dae95b398ea8911980668
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6b475988898eaaf85501ad35a9311326c9cc2ba0c52a4ae8694c84d3c4810bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f4674756031e544d0d4667986f05682c83f360d297abd916eb54218b3b1210f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c63f73b704b7be39c339afede128a7fcedfdb37a3965cd0ac144916395457e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 272d0ff516ce581d1539a35536c325486176088a4d6b25a34b648895c121a5a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4f189e70f53693e84a274ea872b13758d4e13c4b81125979d5bc21bf6959bd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e837c22ba162cbad7fd3f083c56e58b69d9a6b7a6ed78169a41f92794c7b23b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 302b973d02855009401915a70a856c7a61964aebbf1e60b5f23531d30214c450
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cca7a8852b3779ed89e33717db636b31dde6956933dd30d607bccb41898faf1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a483a3bb47b9fb2447bdb2003ed864d33ab12d4c9cfcbbec362b3d149191a5a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dce6eba8c52b7f3d3509fda095b8d5b791356a253c2f4d15e0eb9593feb2d35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e75a2387b7dd72d9b9e2eed4087fa27f2adf93870f6669ab6b2eda8470a5279
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff450eff6b58ed80818a9b754180eecb73621be1a7a649884936c6589f3913b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a8a71897c749ab04caa2306d5d7b718d97bd20bcc930f213cff41f894a55585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7778d52215c74acea75986e0892341d71b3772985d97479ea0febf4d4961a0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b177a21e5f6b010d40b2f81bbd21bcade8effe2ed36f9c5ede2dc4772a449d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cff4b02db96df0cdd07600e515e0b8ad084d2a91bc4476f969dad43c0d06022
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3e8757df83b3fec62b91c11c1d463c8168c8e33ba6a3127137262ae6d872756
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16f16f37ab3981c156d68d0b37acbd917db056da78680a7dd97241c1db6460e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c6f33c6ba2a563e017f3d93a4b41742e3e03418a9648e55aa836167aa376350
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d358951635e32a940a79a0d6953985244164b19ad63aa883989242ea92b8db9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41d4c5bb5d53c86cc28c75d040ab2ca66007080ab19ffbc1497b99a4b174a9a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8f0cd00370f7bf65573b589433c54980a6d8d75b2da0f8bd103a7fd45810ed0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cee1066966da99e7f6c1da0047798bbcba32dfb87821775ef09c2e6b774417b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb82aa63ac90a0910c89fa6187930ff09c567def6a34a32f011139c10701441c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 456764f533738c295871d47e91ebeedb66da42fcdb601c431dcb6fcc504261b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67c4bbccb22dc914c2c87cddd275cd8d86446a691869f9a4892101558c1817fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a3f16fbff42c7ceb29026d0550c1d2d667bf215b5c5b0eda83b1fa12d5438ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb594849b28ecfaf0b0fcc052097f651e645710da27f2b04ae2be4cb4df2a574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8072f52f538e5f0ac38208330c2d5518e604b446db93b92f313ea32e1875b4b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7b4f3d7783f50f9e5b0a38752fcea6a6622d99075bfbd44f43342003629136b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 310335e447f9f4c1c87c876f772d5f83256d623ccb163df1120b22e08660539e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 376880076d59bf0c6806510621ce6fcbf1f34d33707190499aa755a76db0b36b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0204b907187e714362712f4b8c0232ad6330d8996537a854d1a691b121990aea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98022e31187e255d5434272b7115ea19388b1a1c59fb78b3e15ab88acdadbb55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7fa3b352042d2737c0ac9d44d332606d8a0d495e5f0cbeb63439a87c8933428
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bfd81590db7cd70aebef531b6bf8b0b7763fd404750a81a901edbf3c2667185
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7fd1ee0ce9f0cd20ee6e6574c7c156b62cf3bb41561ce033feddaae882d6bdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 923b4b7ca95803a49cb9012cc7e5f9c62d509f379fd803a03b4cf249626394ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c72524e8291b06ccfe8d0e07ffe63d36fcbcf9bd76c5cbb6b6f10b5f3b0bf3d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf7632bfdc35c27bd927db5a831db3df09bc00a237771236754e4bdb7c1adcd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 697703bdcdc4617d4620eb5d46893995b45dfbadd4142630d3d0d69980a003e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c76a18cd922fdad97c5354c7048072817395556f75922a6430f35b03bd897cf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5881899b3439330b2ec70163cd3fb041df02eba01cf360d886900eaf755f2c5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d18683fb0964d17b09351b7062e539d2ec47aacd6da0ebd0fcac39cd53e3f78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 002a63be60f9fc6dd140744f60bcce569386738742538377bc9f1ba7b7f46840
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e28a3ec49cebeef1c39a34819b96926790810d6a46579041a055ad51c5deac2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10545d47fc5d0b7991281aaa9438716aaf899c55c5c2815432979b797b854153
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ff086f00569a923547b18b2067c998968642b9b026520ce8e0aa12bc244752f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 865df664626d1a523d8d1d1f786005fb90c13028fc04b7f7e5741fb54f3be96a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa3a485a7eab5e3398d2c513c6861ebe6b563620d6c002a4d993b3d16554b6ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7f3973da95f06bf6a76bd871e71fde8cfa4dda058625b71b80c765ca5f04440
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0127af747323441d21e4729af67007f0c676ccb0166a52d73f3a66aef5478dfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 203a83d0bbcb783ec9f4ceb1a51c1a95c5a3ce3095194df24b8581075197440c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dbc88e6a28a9e47edfbe186e999f3eb906603948203f126a9741bbb91a6233b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f68c083b4e564902a19de24152fa1bba96441e824e12e99fa6d75c3cdd4f98f
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 283KB
              • SHA256 3f57031a93410ead53b085f2eb6ca9164055962eda3a4c4675f8c8e91c6136d9
              • MD5 SHA1 SHA512 SSDEEP

              memory/1572-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1572-66-0x0000000003F10000-0x0000000003F11000-memory.dmp

              memory/1572-8-0x0000000001420000-0x0000000001421000-memory.dmp

              memory/1572-7-0x0000000001160000-0x0000000001161000-memory.dmp

              memory/1572-161-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3808-2-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3808-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3808-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3968-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3968-166-0x0000000024160000-0x00000000241C2000-memory.dmp