Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2024, 03:41

General

  • Target
    eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22.exe
  • Size 276KB
  • Sample241007-d8vwestcjm
  • SHA256 eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • shoaib

C2
  • pakistan381.zapto.org:85

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    file not compleat

  • message_box_title

    erorr

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • pakistan381.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22.exe
    "C:\Users\Admin\AppData\Local\Temp\eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2220
      • C:\Users\Admin\AppData\Local\Temp\eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22.exe
        "C:\Users\Admin\AppData\Local\Temp\eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:508
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1684
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 564
            4⤵
            • Program crash
            PID:3276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 1684
      1⤵
        PID:4416

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 2ed4d9364074daafae75cd3a86c6959bec92ceb3073834381698592330c08671
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 8dec64f05651034c9af165161450fbf180db5ed2b31b34e942a039f659e7fa3b
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecf7750fb907e1f394ec0a5d9b24fa0206f0f866d598a71b663664bbaf157a5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 796e7f69932aee21a9b228fe706d6c676496276d8294ba6ba068b1d679d77911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e137ffa0e5b2010e5ec2929e48db7a3aa52faa92bc19fbdee63da6e55d735ce9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d4d72cfdaa4a3a2e45aabeeac959b7a366b93c754e6ef371fa0109924d7447c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5e53cb416dbef999ac4ec8e760768161d6f6df2949dc376ecf1d01a98fd1b01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74e4c81eea38293c2b210d355383a5405d4c02b0d5c45710e81428878584bd3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78b01f98a720a998cd71a3df8db6ccf4cbccd99783aa2749f6ecd913962c9b9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae21d19c4fe0d874c0ef324efe4b479ef496b959844dc23cae58ec1a386e7601
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad78615adc75e90da6b8c5fdc60bcbe511f7a550eb9ed66ef8cf1d74948184f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ecdcf2b66d5974b2e5884a481ee5945ca570ecd7d4e6601963eb20a43da95fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b5e8b700c736a02c12029178154a6bc8add974ecb6886058416c42c2a81b64f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc63c60807fed6a6cf6cd33359b8989b46f789916b555a8d9a8a35e0a591961c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45ce3c52c6b6b36bf5bdacbe65bd87e9d9f32b9d4aad2dd77e50d62c83d2c011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a611afc875a805611953df005983bf922f045c16f5a4fb220a2c64d399230af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aeb9adedf6a5f2d83ac06f3699925cfb37d09b72842f5b0516a7dddbc56549a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 833835a8f580d75ec405547fa33e8a566ff065746e83528d38a3abc40a2c0774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be483a459eeaeeb53afcb4e32c2df40c29b53bdb53c78eed95c851b66cb1fa5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08dd003870c65cd55bbdf1f2b8c5ef9ea07ee700f87e251efe30b752e9c7b7c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c95ffae6cb7988527ff8c18895f5a34feba63902570953aebf556e08b4aef56b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ab8c48dac1571a71975060caa5eb0b419fdc682e44ee7d876f476654ed28b7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a33b0f33dc489d181d086b9a0b87e4bfde05f7b98cb6d27429ef2fe22e274b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94e5c9c0baaa543897b205bdf2e58a533568eb2ec6db3813d8b583ef19a5ef7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ec6567ea3c37962c6ab64429694530b8305fe73896dbc4aad48fe55585d4b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddb44f52824fc6820d24bdf9eb265f6631660d0615aa54e132883b359af5543f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fce87073a78013446a395e4243c6be1d84c96ae13036d86e12935a9cb273132b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 901d9aa724a25e3e2578102eb6f60bc87d4782261b59135307f9f34aeb24c042
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37dbda5fcc17b3d844118ea23402939ebf81744d6e8088898945cd5100660c12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96614d3b774a65c248d07ca829adfa97f8b96c57bca646a882a81fbaf0974bde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df6d115907b209725f4c25274cffa0316543e6cf910c0a53c9e2c24ea75c4add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8102f34bc23c48f493740b098ac28abbc9f620d7658eaaf2694bb972d496f26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66313e1a82d588b120c416e1e3187d7cc3294f3534e4a1380883870efe130a7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd494dc5b1c186c8542d019615213d0778b9b615faae0cdd55e306c72325d11e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8e4a07d3a719b16ebd662bee14031a14697838d75b967d6335754749f8454e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e290894c11c53b4edb7b841171b382e584de6ae98faac73b0fabc52f41907b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d4e13d394117b5ff4ec050709b75a4b5c7a1882eed2736173a7d42c385ce7ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16b9421aae27d6f54b9be31157fc3194e90bf2b5fe66d51bb13915e9f3fa0ffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 970017a23c1596aecea505c98433d853dfca06973b43a52b1788d66d70243021
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1a88214100d623f230567ef8773a686a0b63b25bb6105bbc8987a3ad8a6dfb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 300309b91aee74bb52e58f4a7e00c3d3aced6b2913d7b48979fcc77040ef9ac4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad8f544e95ef69ce5ec9a48a36ae77c93b7f99e607178ba8a7c08832159b3116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bf6346610bade8afc429c2ecf3c4895a344cc8eb627c3f6612017c6b716796e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca5e6b54689e70d2dd83496947d9cb6318786c7fb20785bf4e9ac89bea228cc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13e3c09c713611bd19980248b5179dc79a8f90e69f8cf63e4469f908c6de051a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d059631adc6e2d49dbcd0e22f161553c5661f6e86d89efc91cad8e74a926ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e49265f03b767a8f835400ad7e839b67263c85e31db58f57dd79ab980891eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e5697b3b58875168ef917b9df97c9c36acc0c258bad95a32f90e4f5e96cd838
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85d89609deb32096bbff5f9ac1799057ba1d4cf5543060ace857a5667f2a114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28f7460e41f89b58d3a6a25b460da58f79323232c6656d48eacb62e6130b85da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f62b8ecfe921a2635e0e6c3739a785df29067d990bc51ad5a1c2a3e7eac8ec27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1d375b30157777402bf37e790e51918d0270a377ce9230df83b78288084f3ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c62d4cb13634442155e2ae234480ecb4d5bb1a61addb00d3f6ddf33251eb16b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f77026e4f8bb2358806b053cfa1ac6888197d226cc9495d9633f74d649b074e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 962e9eb5eaadb828030b1d64e302774632c87d8df8aef379c80848fea6750b13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b19edbcd678be64651c24db3f925f81e61f538e9e1fa8f6702bc2db92e062a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d359a4461d89e80e6e7307ae3e7cac9e126e46c2b7ef90c1f14d7a50f4e3ed0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bb36a810b832fa126df64bd7e445793c56c1c690403b9d69d6daf5e1b9d1a49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86df3eca708ae06809ee81dc146934e85b531e3ca711229760504f84b4dfc37f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d28ad972e3cb07decf93825877726ef58b18e8dedc53cfcdc16095ace529ec9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 536357c4920e39e756355466d1709ad7841a9ae908baf8d14664eab78adaffa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c24cb0b25d478971c8dc4c19995671cd3b3a86ea7bb3902583c786758b74958
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 305cd9f86887a471e3a5c23497dd7254a75ea3ffcc319d02bdb91157c109803e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f346b139595973b96c9038ad927496ea21327c81f11ba4b5be030ec75e3f33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab2e132874e691f4c6a2e6e0fd2e0f618e0f857d0187fe83f81981fa6387ce75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2da40fa3c1f439dfb5ecb103f84dadefb43f04aeb078ae259eefd1e16b7a362
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3f6f61b52d4dc47d369255134a4475d49f828ac912fc9944740ab8b4c01fdc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f500be4d7ee952548494fdfcc511dda07149b3c780b51e3246085b8378625fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c4d39c21e6c0a3146e0720e436d3edf786fbe1a5d6d22c1542af4b69609f45d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff8dddbceb240d78a08844a080ed8f9f4f43fcfd0597fe2eb449d3f8cd4f917
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b6c2bd8bc173a9febeff1585a3b78f840a24cac16da044f2b0cd062e30fe473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f913a5f63edebb205b4f954d6fcab28219982b1c7efa497c211bed25c132cf95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67f241398da2748a6c518b1391400c4d9176420d70ccf9ce33c54efac2296423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0d970bace71dfc40ff3a86e637cc465628ba2411bc53559fcda5b8b99b68e66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54c973ca28b3b1a89d7af2b27cd2176f40da2baecd4083e4a35cfbb8c0c54e14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a78015a1f91224320d0fd9d6bc160eb57291e7635fc9f11757b412aac4b09b12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7d3ff017aad6cd4dd8a323aa355a77e9bb4c0f4d52cbe10696e021f48b8460c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 862eed39580420914527e3d6d3d4a0c2677a9ac6048cd394076720986e5b2964
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2f20319b261b9d5fa76111cf4910c69e49659edb11496a0dadc7d067ca7ea26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc73e11b8527e4fd569c050ab32b5f85e92a153302ccfacec06aad8c1fb6c705
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0883f30410429f44e6e4b68b0c67d8c936b7cedcc413a45e679401e02a10d70d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d137ac011f88e814952e7fe67e6ee66d9912935c57cbf22c8176195c2402d7a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e4b73126060fc0ac5a8e2a0af0a2668e0e3b6c102994ebe092f3041cc6bfc28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b96d3e488d2d75cc387a7b84c3e5a40aa2670cd2a3e59d4b1b3bc68941a94120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c9c33b776a72c5e054c66aaa66e86eaf7ca3f9e8343fb5e6507219184d9568
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed7abc379166f841f68ca5763c1b51184645d0f8b6349e984ae21dd85cc54c78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30d5f1d5d075b3a66d8c31452239e56063b8d75a82a41939e9d2a2da16f76463
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fa08e7dbcf7d4293b45e62733b278130df292b63bd1bf9d9a33ac6ced31f0f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b86340cfc5731f2102b2a5ae61555c3479647f14957c2292b42136b9d5bc465b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74430137c4b55017dd29d597cab86483b82c72712904e0c7eecbd12a948d9965
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 149d2bef0a085d4c534e8778401289894d000e127d0f2f3cca9cbb8376ba230d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d21da5e55af369897224714b50a0937902ea2a69f53294283b2e349dabdfb8e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3fd223c4bb80a2bb04116d7839d405ee57bb58464d81b215b96e808e1797bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0973358ad44e11538448ad32a021745186cf950dfc1976f8bd25416f00ff6311
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 652fc6c1730a5a562a868930c34f3385234dd5ed165ff4dca2aeda8cc7d03e8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b291fc972270eb5bb85476fee86667ad710f34a600c24e82306755392713240
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b7eb6e882c873e790a9204890e2b20ae1288384aa8b59a819271138827f8c2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9b2b7d1421fc95b938338859658d61d83e00ab12ffecedac93b8fcc0afe03ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 550fb541189a03b9d0c8f90b4cd0202bce39807818435c1ecbad27a062fc45a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dc4950a013f6984debd2f1bbf3898722e1ab43c465ad3b110693e06bd16fb3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e85a168c684cbd5aee2189ea19a73c90377cbae47329e55e3d7cf4aec63007b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0305a0ac28c26e1338f0dbb975e82063fdc4e689d7cd0b5a72a270c9e2709996
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d036ccc9a498bd0d166a2e09b6ae04ad37fc8e4cc607a5932be0b2715fd2d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed629d48cdf29f38969157533f2876db3d107c8cdd68eba10c8067a1fb33a93c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c10eb2b6ead8b38afdb99f90c2664e0bf6bf3a02875bc7d2ca6ed398da313ec6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b46abe16c78fe04d88e4f422b81304aa9d4094592e79e9749e1b4d1274e0df0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6fb139b54a980fb8abcdbf64fbc154943db7e1b379e7f621bd7768e147f9634
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54b8b84a0752c48413b7789f665dd4839eb0949b0efe24b92da40dd23ae39ad2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c871d3fa5dbfec3da814d1b45c464a06f385dec14fef4e555fe1bbaf40806604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7ed14672b09c156b4e7f05bee524299a3c02c790d1224fe3fa003e41c48e6e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1dda2e8e088faf8c899be123f7a58a8b95af48d429b97c0ddc1349b4c24e3f85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6ff4d4786a085dcc53f6d44e2d68d8b8e06b1a55bd7cc36e597b936a7d8720d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a31f6e6cfa9e469e782cfa909fcac27dcb7d5f120f11f022e7135a8d01ab64ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4efef2f4b7efa2d56f30602b3ab54a52363ebafc84a06c22bda685c3f981926a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8680127638f3de109b305eab8e5c65e8c6db4c706e6913c02a88877284dfaa19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a84d1fa3f913bb366787075cd65f009346ceae38d6adfeb3e9d7e5facb546f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58475b64aaaf545255c1129275a985b593c60bdb523c18fa57b1b7db50e4ea43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77bfc5d6aa518d159dc3e095f99f3827ad5ecc9061e6a80cdc51a5f70252b798
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d9f4b2111a47ca625e33eff787391e7e02566d7e384dd594fca992966f32bfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2baaedf232331b56a483b2e22aeac3f4b47c03c8033829aee30a6d8de086f87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19b0220829cf0588a4df586a601963f053da8517e0a860833a2bed77ae7f5639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6868e1dd4a4714d670f554c6c62eb3a701b3bc4c3100d1f21d39d9b69bb64029
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3aaa6626ae5a14dd0d6337cf07dcc4f7a25c424a11d0ec0a40622b7a0ec2e30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7a15959d8ec17c2c1f241a6944d420ba35784f5e53628933a44bd6dd21855d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01819a88d4543a45ace81d3c4160f256e82a6a8a3ca63261b381b45d960d04b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d40e25eac38378fa39b6edaeb680276f81589cd88629ace871e3af679d697e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 644311c2a6e522e5a8ca21c3cddb932080ca5ac03cea1d5139fbc888709b9029
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1dacc2217b39c8f12bd93fb95f18699675fe76f7c2abecb7e7009804ed28b8e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 983e697092e8a630b5bad7adf3ea1e1986a4301c0d15fae42961c83f6d0dc87a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9ba0fc6c0bc03a1d0fedb9116c9f2cfb6b7226321eec74a47182898237c3a5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4ebf702b95c17cf1642f69a9f9839042122f46ce3a01f90c895e886c69dbad3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6daedb019951bbf2e07d1ee07ab4c6f8ecce8d2f1e7af8b5828d5a99e88728d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8de2c5827bbeae5d44ff7eac36f03228d8eae9833079709c80835fcf96e1d003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 660eea1321510feed9ea04531a1aa12ba05541edee261c710a2782f35b1fa408
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56329d8bcdb450bce259d121a8e318c9c55094475c964234d07b9b18b1a1333a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e50de55354cbd400ee33053526e6ef5d5ca345dfa9b30f14f3c4ba5a55b55db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29642d30ed9db36a55b445950b585d08e97de78e9c7e9458186ae3fdfabf976a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 594a9f0c3a489704d43a307048ca71a47a1b65c4d4cdb1f61467f8dc7a8c8526
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b50d05c75cf55d83709c7afd4deac2de80c75b8367a8c3a0d51247f7539f2fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec86b66b385fec063bced8a5554021e9951b24deb379d24c30a1a672712793c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edf5a35b91d1bd848c3fb2597154e5b4a1c9f9da9ca825eea58016ca1e3aa740
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1f5ce261c96141ffc6e0dd2f25ce3b757028ecff6176b6481e93711f61357a6
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 276KB
            • SHA256 eb6d01109ac7a8034329e1b82c7e61dcfbc0acd88b34fbd4a2894f42c30d5f22
            • MD5 SHA1 SHA512 SSDEEP

            memory/508-104-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/508-26-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/508-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/508-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/508-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/508-69-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

            memory/1684-99-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4860-0-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4860-72-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4860-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4860-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4860-22-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4860-66-0x0000000024080000-0x00000000240E2000-memory.dmp