Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 12:15

General

  • Target
    d64a4effaacb7ce42b801bc078f4653d_JaffaCakes118.exe
  • Size 419KB
  • Sample240909-pe1qcsxcjp
  • SHA256 36f7b1250d24773396cb174714eda59b9798145356cb8f6832bab3d7ea0c6454
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • zaina.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    This Software Of Hacking Please Disable Your Anti-Virus

  • message_box_title

    About

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\d64a4effaacb7ce42b801bc078f4653d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d64a4effaacb7ce42b801bc078f4653d_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Users\Admin\AppData\Local\Temp\d64a4effaacb7ce42b801bc078f4653d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\d64a4effaacb7ce42b801bc078f4653d_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4140
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4888
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:624
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1660
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\SysWOW64\install\server.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3648

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 70d679be8d0492db18af020d0ed7df31f45fdfdaf14fea9b77551099c4744cd0
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 d28cf4c67bc41a8027acfe3467e4dc603b7c2012a270a58d64c4b4f841e940d7
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 716f8fe91168c997c49adb846c4ca402109a176197e401b64a183c526d0315f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 75f2dd505cebf93dce5ca882386607642eeb781ddaef193d6e79da1e5b4f3934
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8280b48146be859f0d2d6b69fb2f36a91aa447aa475d37667091881fe1947ac0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9044d1ab02dfc1bfa9e681f6d2e5ce091cd4c4b68ff7e857914e136cce00b3f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5be8fb07956a843173e19724a0fa5c5e64f9f0e1a1b7320dcf1624c4877360e4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc59300fe0d8befbcc815006477bd0e6569ad803d95c395069cc18563584ba4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ba91d5d519ebd5309cc1b43d7dc6a5015b270ed9fe4b219f03f49f62aa6ac719
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce66da79b8d22a8cb9e8464b4f25ace3f6615bef556e23eb701cf7397d224632
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6b79e8a2aa3264829ee2ddb00c4ec9bf26d84c4f6e83a3f7c5154dca613d287d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cf25ff1387879349228a18db4b523036f61fc8e15b7c2c40267e4620178cdbe2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f0cb65626e0aa0f78a5c7095ea28e6f471deafa9f6c511043ed1149f99030e64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 600ad7a1e6afe8bc1d6208b7a3a0e4328da959188fbba5b829409f1e2df25cab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc56d2c7a8f0fa78d7e55a1dd83fcc042e6c33bebeff47c080b3515727958c92
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d3592b75eaf34b135ee27b4ab01c67cd25e20c681da18cd6653a8110eadb249
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9fd399c990e9f53272b6bcaf43654c14a9a181fcdd25f703aa3f2749c542f4de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b530c90c03566542da9163ef258f53bf10be8aaa3df56840262b2f354194ba01
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b85ca49fd5c078455d3987bdb56247dc9dab4f3d82b68fa8faf7e9efc0d02ba8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6fe7db1f6fcacef848f6043d974e4046e62d60b12949aa9fb194ecd994929d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7d7ede46ab463da7de68586a866169d8b9b150cccfa86e4251e704ef6c1cc335
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9426dd0c1cb7e978a269bd9980634f861e8cd54986af4ba0f58d56c9292a3dc2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4f9ea2df886955518f6e1771a5062c052843e9393a7f8798cc722d5102b4c3bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 340956e37e05d1161fb26c5b8c42c42865b6ddaddcce6fe8e8c70c9c8aeeeeb9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6902809e897e1f0a0c9f2ff2bf84f5b311f93de41cefa0a45f4241e62709c5e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea542c56c273e4674b30b7b7e16dec8825e70a75f7cb91c48fdd7685404022b7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0915722bd8e4e5f4e7783bfa04338576c1b509b16e71e4fc355b3ef00ff96eff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db5ee8ad25c186c74f810432aab35290c26b5b2c0d8b4994736ee32f1ad51aff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b40eb45155b9f161329f5b3c71391462534717bcceec85fd5f4ae8bed8a760a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b450f0febd5ed934ff8f9af43488469d2821bfb600fc91deb519a108b7d6ca0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8124daf269973ab1f32b16fa1c58c791a1224c9d714f03b14b88910efaa278ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d9f5260598ccd48612a80e514c1e7e9020b66589a48dca90d897ea9c56ebd03
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a97fb70e2570cec527b2881a5273cde5852677dec2d26da6fe9f74253e30d033
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5640605855e591701745dee884c19221f672ff68db68a0b3e41a8da6101b391b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c419fd6efae82a084f2310314cb7cb0f29a5197cce3f698ae43e23056b01536f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 026d305c364d578b1de53cc8358d37f9796e09a5965d59280d2d806623d58a26
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e39989723144d4ed9e98b7e7a5d617d326f4ff4b9508550bbed9b5e2b098d41
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dbdf8818c96c730f843de04f89c8626c257afe788b96ee99246455289cb21ca0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 355c5a3ee2e05924949901df199657f924803644748da3de03d138ecf1661a41
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 14d304167f50042331e273980b7b0bb8bf6c45479c13e8a9ce30f81a117fc31d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 282b91e1fa4cb09bce7d293fb66672aef1b75c8931f0ef8b04b150aab94a4044
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ef1ac012eee1cc6f1cdaea79c0490cdedfcb2995e1c48c2cbed11246589693f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2e3d4e272015ba9359f7b7efe89d95a144f14b0bec3e9cae8d909e7f1585976
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de78c5e4b6f6f451e55950ed694318abd30b6aa3ab8b655936ebb402408f90a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7877adf97c4235ceaa18ffa3305f022701a8f2e8ca7e3aac271d08dbeecd4865
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 728e0429eabc81bc976cb2a5993739a3980e4c80821fbbbf64c179bd546dc170
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2f418bfd72f584b71e2d74db862af39eb529693e8de6b31c67ee2f8b77f4919
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fbdc33d91c7524e4ce21262fd413cc8955a6a28d5d3d645b7bd0f6f8e95c951e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6769f6d944c6e0c437a1887062e69864c4c583241b226ddbd4d7099e2181434f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0b0483628aeb97b4eae8dc0fe38c9fc51307ae82972de1d6b36627d50d94d2e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd24de0da60b99aeec240d5dc869cab45610d79e87661b9e00f4da137f1a24da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0012119ceada7f284bb95abb84cf92ba13dd12f33430e89c3bee150f3684e04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43ddbed3ab8b497b6157d6b62ad4df7676f29cf4dc6503ee7119b86f3b988158
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d7b8a475f480e560537803d7f8be97b86f20ce1839db41584b23e5b1e747d1b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2b9c4964e8f5e25b0d4fc41d902d45db340ca91bff2d079c7be98b3f76abe17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3593be13342ad047c15351b55c9c94e08d8d4a17e0def08fb2022e31a695167
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b63e426d29dc0b5875bf50a22ef2dec3df181bd068d6dc81e6cd7b69c3d34250
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b872042afa61b84171c65073c4832d2bd2865be032f91ca5e5591b9286397062
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af19ea51c369322838b128db957b3bcf0f28150a85d7e1a487d5eb3f4b4a8f77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bb0b163c48f82a6123735566cc6a1b2680d43d7e887e9ed982c5d3c684f1e3c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9023c41e78ad258f814d26e2dec6df98f6641e026b7fada2e69745c00a65edff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e64df0490086390a567b45e373eb3c35a53a9389f772830b9ed00dcb673be7ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 584b1bbd698f8cc5177ae70ffa798043482067730592db43670cc1ac6ebecdb8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91eb8e9a6bea3cc05cefce5a08225472aea802910f7a2324ea228394e0237028
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f668a9ab3d241ff9dc16038895baa7d85510a4666d8f6d6a5c5fd82546b4a289
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 111b2e235e8313e75b866a88ee47e716f002477e290622f03735ba0eab62cc6f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05a6941c1ad809fc66aac9041edb68931ab048bf11fd4a9c9614ba5e022259cf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4117802d87736953c84ff92a105b4e82f4231a713615208709f054c8d7591d72
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 849937f7be81cff93fe23db158ef38a8fbe86c3b1632e3f346683aa7202885a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8f9d5baf6e4123ba2f9a3dfa71bcbbc8a65047f73881ea1dc879b65857f37f30
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ca7a6eada9f5ba0f63d9939ae1b679a936cac0737de57db4f9163805e7728d82
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 999f74bc10a8a01298c3a6206be28ed5cea13ac66cb68cdd7886d9ce8eeb27c7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0c0832c41a43ac69ff727aabe8eb8efb2855a55f20ed730c5c0d434a70c7416
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb469aef2205fa397a2f1f5894873f5c86e4530f50ded0082ad1e6cb42893880
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 64ef61b333f5714e102c9bc9c6f025a5b602087def65e592cbcf36962fb6765e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4dfa247eb0b963725e779039129debdd083a3d62fe3b16c9eaa1bd2ca82489fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec1d4acee3ad37b6c00422a60811789aeafaf870766e5bd0adc68c04ac60ba0e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30cd8a9e0e5e61721b3c744e47351a2649f571be1e2877ac070a4a00501e2643
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 81691085b4cb0246db18c4e866026e888b096ca217e0b563b3de484d0e99ecd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f3bd0ab9b453e2c115269fad2f41a529988e3dc7d060a0f487cc662c9259d03
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 accb718b502f93de40f5ea2a33e1ac0f572565967ad8a6e97e5e205c2c15c6fc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc1e13d40b783537e6129cb33cf3e01da18d0c5ee0a028f3df973f041f9f2692
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 60171cc04e0e4c23dcdaf88e63391b9ea8b302334e703ca02a0207960788c9ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3a4f9632f525bdc4ef106072010fc065425f73f25a7cb1340436101159f9a57
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2015ca7b821cc5c323a14a6a2918bd1a23847b0e2fe53688adbfa54413f2f940
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b635da8a4d61beb6ebd22b76a6174e6a0422a2f4f25e43408d32420021bd3c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2cd7c97279c818f0afb12d251a412294881ce93dc50142f714e1cc9ee9a47d2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46418526a8ea6ea01a462295128a2257bd91fa861a76a0c17cec25e1f79cf06e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5cadf1bad40368ba107a59044ea776a9afcec5e8c68628f2874f2782ae6216a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 850718ff63e1252ff1495d77f1a664bb6ee31f10018dc1be2f3c2dc32f7476c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3959bd30145c96f0abdbeb5cc98f8ecf0ba0c8908670f127da3de2c87eab83ad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afcb59dde74cccd97cda60dfcbd0ffa4f681cc8b6d811243a6c60ff92afb820a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f251443b770c9225db0332dcf6c7c7c8cda44df4b1244b0af8151bc34ed9207f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3de11c8cec46d82b0b30b08120e4dc57ee1c9c815e98357ffaa3dff53125b8b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 874def36af63be21a834368cd1656fc26785e20391e3cd83d311c712b6da5166
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2dc31133dc77799b379b27020c1d904022b679300895010ae4dccaf6f60fc345
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7fa6070527354dd9fc1b9a02bc6529cb14f9b7492638af65e12a4ffc7609ba0c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e198b1f35f0542fbfcdc117e3c5e7b30b431982177b8296c74d5dcf75b16da6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c261535c1a4eeb7d3a1945c451fb8090b547880411fc05b51b62d3e6711bcd9b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7fdd585d1fc799b2ac7de670015587b3ffcae8feb5b9e14d1675f1b3124f1a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 01063ece5337d74c2153c55fb1a762ac4d007a2be2e46236a271c347b61efd4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0cbd92adef17ee2fbf72e6b60241c0d2525be02ebf83953def4f0e8e930f0a4c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c45ea4516e87fb4cd20eec11203a93ffdb21c1d5eb02f7546352cc2a1debda7e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 13776e620594e79f53820dcdddb13d60d7ae62b0aa32d92debe3e7471916a32f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c26c4a6fc5ac9906fccea575040e0d904e87c8ababf06ed887be02f4753fe808
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 294bf91de7c8e337b007f5226d096651455d7c3a8fc745a56119f6d4097e7e37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd85289408db20048d9a185c7ddb83db9eea4c83271658171f21e02ed016d2d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c36cb46367e9b40f26d512ac4f9034ca7d4f1a69270b09c15561b7c27d776706
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 21592f6fe79e1f38332391d2852e4131d91577d6a5cdd83efd63fbffc774ad19
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a22dc3baabc2e4a0b2c43e80a3d35d3597617838b89d5af3a1f6f9116cc2848d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b3b9b10028963f811d6e0136a9ca7386c1d84dc8e6e73b128cf06e264c93c9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c225012a3b7958bdb7372f3a461bac42114076c9644d5a4fb3d46a9bb2f70f56
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ab0842603a96a68d6d2362809fb0dfc386a9334321f8b316b75e66b724effc77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 188b1723826b8e9615b2355d3720ccfe7ae6220b124dcfd68f6c0fd22a97e513
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fdb9dc25286d8c1d292068ad554692146637115b91e6d80065476da74460a2a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9a5e3cee6068345b69f8f5c3d327a555d02e97fcf1e1762ea99e7efbac39dd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 07753cb4839352005afca868e096d095a72d0e96d899b90463850eeefb63d9f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c67b07bdec4c9d24a10ad3a768e47eec3f74e16cec67221a4a594b5b52b0778
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e7b40d5635ec4ae6b9a5de64108b442a78b0aee47995fc798fadeb92b06bcc5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e73a4c291faa60b390d18d70e0528a48d56f9c04de9badcdeb14437380a74e4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e8384af2b886acdb0f205b731d3d71b2cc55ccd8097f43bc801d11ee57b3a6c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 108aeccd4e35e54b7e73ee0013e155ff1070b295e587660153fdaf39a891e632
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c28f93b91be59c5acd0eab2c0c62f035fb5a4318b489608cef3d29a6a0aaf8d1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 453f256985dd452f4be046b02fa83a45907b57729c7886b4dcbdefc285b5335b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b573695c822cefaa418bab0169b81c48372600b6311f6350f6409d051c470ebd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05bba738a6cc7efe4c05daee4e6b57f79ee9f9d7adb316489485a5c7931e0e64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48bd068609857fc203198bf0b9b4826276150c3965c44b7b08e6fd73fae0b780
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7479638fb35eecc4d55075b8ad020568aa2d1e6e76be4fe036baa1c6149f3407
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bbee98648403384baf35a54a775ac72e73549c73c24be3fec521169572ec7afa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4a786d530b023d7fbaf06158234bcc37af569210c479f243d84eef3f8029b7f9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b3b84ba5e68575ba966f118e53cfff2b31510a3c4cd3b3c6695d42d82357e0b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b7117c1dc8fb7088b6436b653a31e83b31df0c49265e2f81f545a2278cec57f8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 326f40e85c972c58bea3268a4aaf353885f9992487985b44fd19c4963bde1860
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6ebcd66bb13da19b374c68d6d05d4a2e4ebd82192d163003ea32ee8eba58b251
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 89c1e10417fb35a6d0e058a1e1b0aea86aa75d252ac8adda24d0001ce20090a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d391c1a45c4e5a5ff289feb6c5106bdc74a1dc3ed51277513fb493b2ae9525f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05164e4b379c2f7ed504f130039a6903e1713a8bf36b23105dcc421f635f3e28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 013ea13b455121b4386518d70b1e2b2f3d5003d3ae7d232943c65120ca9eb27c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 70609ec47b36f505192a9327505863feec21726be2530008fd6e5bb7c6cdc767
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\Windows\SysWOW64\install\server.exe
          • Size 419KB
          • SHA256 36f7b1250d24773396cb174714eda59b9798145356cb8f6832bab3d7ea0c6454
          • MD5 SHA1 SHA512 SSDEEP

          memory/624-96-0x00000000000C0000-0x00000000004F3000-memory.dmp

          memory/1660-167-0x0000000000400000-0x0000000000423000-memory.dmp

          memory/1660-173-0x0000000000400000-0x0000000000423000-memory.dmp

          memory/3028-6-0x0000000000400000-0x0000000000423000-memory.dmp

          memory/3028-0-0x0000000000400000-0x0000000000423000-memory.dmp

          memory/4140-3-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/4140-4-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/4140-5-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/4140-7-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/4140-144-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/4140-14-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/4140-11-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4140-10-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4888-15-0x0000000000F00000-0x0000000000F01000-memory.dmp

          memory/4888-16-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

          memory/4888-54-0x00000000000C0000-0x00000000004F3000-memory.dmp