Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 06:35

General

  • Target
    jaffacakes118_b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2.exe
  • Size 324KB
  • Sample260924-hchcnsty3k
  • SHA256 b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • Victim

C2
  • dmc-jny.no-ip.org:1804

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      2⤵
        PID:4932
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\install\server.exe
          "C:\Windows\install\server.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2768
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 620
            4⤵
            • Program crash
            PID:3924
        • C:\Users\Admin\AppData\Local\Temp\Mic Lock.exe
          "C:\Users\Admin\AppData\Local\Temp\Mic Lock.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2768 -ip 2768
      1⤵
        PID:620

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Mic Lock.exe

            • Path C:\Users\Admin\AppData\Local\Temp\Mic Lock.exe
            • Size 36KB
            • SHA256 670423be7609ae2c72bba8da0d2fa3c8f1fb5fd5a29e2add63cd9b9e6495ab79
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b8f12de09c1bcbc292df7794c06a9d863aac3fc84135eb35bacda4f3ab47a3db
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 266KB
            • SHA256 efe70049ede6de711746f633689cc6f1ee373e8fd40ae8ff2dc22e008434e21f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7d1946e2cc848d596df801e722580d49b44406f4f42904b867d73cca9a2792e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dbed83b2044bf3ca5d59902fcbd065874918d30d95c87c41f5163f5a40da8b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a458bcf1b4a3382c4a4d465a774df57f65124286d7aa4b952dceb0189e7378e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6d11266d293a11e2736f107dd5a4782a6da189b08fd0266a40136ab9f7702eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43c6443be0f159358e7f507c76e5130584a6b156ea008dba99e7ee69d7f436c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d0b6222370dfb18baed2d1875fa6de2b6de0ccc957ebf0d30206a1ce8b71f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f67cd7a17e9cf36f20be3c8c45be9a1ca0e8278d6d4727e1633c557ff1972cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c8a556520bacf4c1a2790145214b55b98ca4fd9fd58788142f7b7221607ce6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a60e1bb43c8bc75a3ee51852dc608cdbcd0e9f39daef6a71bec86fd87dd45ea9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c775ea73a515f3afcf3d4227306ffc45bf3fcaf75e8d573f522dbddec86ef0ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6b62457463f012d36b5cba410a62b329fc7237105e11f1d5def2dcea2741efe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1872d09445b45c581be15a3f5223b956c222d4173b8b527f779387ae9b39e980
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fabd4e63ab844d98c9599ae9eda01f73c65ce1c389033c92f427a336e5b731ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4220848f00253522dfbf6d00879615186fbb07e92f03297923d4f0d86f5395e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a8c0644f4933165ffc8d4b9d60cc5524d55065257278f7f64982ad5f070827a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b3480bd0edae2f819b248e906af843c96405af365d102c42b29429a202eb03e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51798b91df532f098edc8590b8db1ff9914cde759c2d54a37f336a2e2e42b824
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ad9bbd872779a351203c404b49f7f7f079b607db3c6a3b889018d73847ba9be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2723f8350911d284b1257ca6305678b8a5b701322b5fe6fa2d3bc81b6a30991a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87ff856def80887e05318681160138946e390eb7ae4ce8d6f27749f277d103f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28e1867ea0fa24defee51d5a91aef78f648be3fb0d58a05ca63af6c8d6b6bd17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba1fec2a136ba0c96c28afe8c6537ab3ff425cfd2dc287d9b98e9a0cc35b06b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 335e789a6125681aed02eaae4ae814758363293234b35c4f31e4cfc0af02f5d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05542db8e03c61865caed3f895844366d934fef88575f7f1ad854daa3aea53c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71e06262a8570937ef8e91990f703323a8e7d701d461532c7f16bf3cea26efea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d147008fccd21472f5ab9af0ccc8eec846ae6ea409cd29014d741022db37c827
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb3fc4147ddd9361216790bd47da58c4d3bcd173cd4ee480327d48b83fbc4fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66063244c999603014d683e60bd92486544bce30e562aa8958b4f8b12304e473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e971d68d19dc9ecec18d802e1c3fda23ad900eaa74ccc437f02e078b137e148e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac528e00a8f8468d8ad84ddba2bcf26011347ce52dac70ca11894fa32de58d28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dfcfafbab8ee846163cec594193ff2855575be45ee0e0cb8fb52b1e7baf7d9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2fa9041f10efd80f4fbc2fdc0c2e5fc0365465fb3abeb0069a0ff5867e30aaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbf4970381e154645b22c216d8d940541b65fd5279a8595199e8af18feb3e101
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad08d7d59e53aab189edc7c3b3ad9ca4534c0d686740c35300534325c56975de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f6ef864501592df3bb8fe07cf76375e06577a4039c4296f05cede1b9e782adb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6be6ae1edc9556f9241a0babef0f3a54ca0688e476b3b9be4c314fccc6c06776
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 500f1c163672c8fd11d2a76f1b353516a169529a6924b331822cb3ee54b4852b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58485901cabf4544ee05469d916e80a2b4092e51781b353d96d0797368e30794
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 149753a3b27a9a07af8e54c0380710143a0c6a8681c46dc01352855f4fea65ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9008340122218859d86f09e7a048d15f5a365b9b267f5d27de4e933e2a1cb78d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 694e7f13621b988cbe230ac6aaaf91a8ba2ad13c91f3d577c25e9d351b6ed386
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2901241c7ab22202031f953b131987c08099a837225a073bce2a7b8b61e8a48b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c65e9c78371c467388150351b1f2179d987748a5cb69b301abd88f08dc5e60f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07d2e2ab00d8ccc3b2ddcac9c8c3360bb1f2c15e0c7712c33fcfbe6f48456ba2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e40600031bd2dc5c734913fa8077948361207270a2711174bd43be8a8bbc2607
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66fd3e1797501883d9ec4b8e903116565402630c12b42c891bdacb0b87ee6606
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fe5bf37ab43c542f1700827ef604cf0daa6a899a9b7490fefb5e7bd7bbe8244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39ccde938a530bd3456992d6dce34c09169cedfcd97e838ee5e55f02bb778e2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99d83eae82732116497cbc28021f0227f0044d2cba5baa3b97c339fa7d068c58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eda808aab203ef723070e3c509ce754a92d3a0c55916703a14df7576fb6eee66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 886e500ac9f2ee115e88e72302866b355670b4f47e2afa07222743c2f256c8c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8b3b2209588ce41b978d80f289979f70a9e670015abae673b51c65286ebc089
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4924164d4c30a5b21b957c08cf772f17e45ba4f2c58b09c03245ffebbec9705d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c302d6445765ef62b8a5a406d11065e1bf60df7d1d6742146d81d90257c0bb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a98af011d646cfe667de7f74451d6bf146e425fffe72d1bed6804f9d85d8e0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bf4d1ffac30f897773e3d5bb724fec351d69cc97c5a30d1571e37af7d6fa1e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8065a474c4b5ac8e27f74795eeea29e28990e28da5ba84fddfcdd45d6ffb59fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd8bc59cdf597dfe3b0428ee330884c0d34df7fd6efe864a4ece2729841790ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da4b9f2bddd95e517d7eb8f551aba0f7d6d6cf4f8043b9ec5c4aebbfe19b9b74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb546f226b617a1f7caa8aa954e6ea4175bab866427331fb5c29a94d9e25232
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5deb2b5225ae98e590b9b65bce3cba08831acadf58d1f4543118f9c5bb42fe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb8658d4f44bb72a010569223ebedf4c1ddd96a1402011f833e6c901a305c348
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94674246d04aed945fd26e7cbeaba09aa04074c414d4aa465514603a6ec90aa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 400c75a9936d7de3d3fefa287d47ba050a35dfb3e9f460b72aa3ec4d493eb836
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75f0f8d59f23e93aef6b16be643e10d66e69626783946049278ffe639fa735a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b1b8a12a9d48f3aeb5df26853093ee9740dd89889a7a83a9f937635327bf502
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00e4e100c9de6f3dd3bd81b39ad600441484daa59ef3c10bece45018913693d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07146425f345707bb8be02dc2a256949f90599673cc298406622026e512289a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 413b699d2463f07837f7ac0a8a94a5f144ec7e72cd7d02b05caec824369f633e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8f1a8e0d535aede818100661463b429b40b5a804139f35b4ee7de53201e0268
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fc4ed017aac3c8c95a656e71e5f2e52d28f6bf1fc518b5349e81700545732a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1c0dcf43c82d039c460311b9897c81fb2017b314114d8f1be8e5bbb5b52f9c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b185f2eba092ef8f2e563694b3d6cf08a9378c1441732613e2f64f726dacea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa64752eda2d6e1fa91cb3dcebebf55db7e3e9a44b2eb255b7550d6d1499643c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5deaed0c26a115c578a55096840ade1476c85cb617edb7e24d2cff23958aac2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a69df5a1cd9fd87cbc08f0ec8e3a7e72c2333ae21dfd39dbddba07b9a80c5fac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90cb72eb11fb493c975e7ab7ccf1ffd000960608f16e27c7348e3c6839238cf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d134e539baf8418b3189a82801098a94dac7d6f06451c8098bc8029407184ddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5efc20411095b26fa3de30b41a8bc34258373cb6eb8e577a67290e424666c2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe2956ee8bc09c1a9728c9b84b19adff37e88399b1e1307d09f4ab496cee2e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d725d1178391105020b890d55798ffcde94500e4906e7352d1afb86abe16d0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9db209cde328ba12273b0c9d544671c47b86fb4b7d9465edb20ed0cc6c749fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f61a6b25ec1804ee777c9cdd433530580cff89094d5f6507d64a5cc7486dc9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6a777ef5898b7f4ad3c5d6554e6ef4e26d43889e3e6afe7104eef82696aa625
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4066a9c4b1e80f50b381667f1751c47c0c342a2af91294bae84c32567404900d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3006eeac32b2e1357295caf484de898bfc326c1a0d4fc63ccc094ab65c883023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b02086577f9d7ccb1390cca3472f76bd2a678cfee635eccd491687f1d675d4fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c55e1f5c557d79b4cf13cd791cbd003d5088848e013b870b69fba418244036d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44b034f617c6e9f1c7c643dc6bd0a4e930269e7d74b5ae81de64088e559cc262
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71ebdce017710f67a793e87066c5fdae9346c7baf715e9c0dd4d856df8a48de9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26ea15264f18a24bb1a6812ca2fb82b10934ecc9065fd79da6f9e629a8f71347
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0428bf6326d0d2aaedde738ff2a048b005e0956067932b1a251d3904d56ea2ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8358a7ed74d723d83cde684b3799b931340bbbb406aac2f1d1d502cc2b0dee36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60070455870510d0c71b8b5f274cb4397a2b3259984dd48bbf5e0a746eb6b330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d46cd8bf8d91f2ad5ee2476fc6997807b98d9b14f099c32758cd884302df69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc96d3d5c55683c48054a30743ccc3905d0e1b6b087815050752164d95d3cf50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e18e154ae02facc786b63528072b37998543e365349d3cd56e0c801f2857a1c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 387a720e5492d022d0da26c26628d92e1a0bf2cac5d7d3c4ac4def0259cdb59d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9876e6b5a39d0ede063a38b6b594cfe2a376f8584df08ec9fcfc9a83e8d8c0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9849b4cd067ce88bfde6f912ca620ad13d8917bfd0556dfd4f9444f5d0eea97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15e2312f208da4066c7b6603b1c57b4d6ac8959cb1901a0ccaf2297a228b3fcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e0441f093b99e555bf55cfb172c239fcab4b331cbc3f07c32a5cf03d0dabca1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba0c65dde72480d193968bc282f91ee481bc6fd6b19dcf61bc44f341528a4075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e21f07720c9c099d3a67be3bd01821de1a66ce0e4e28b6afbe5d9dcc20a5f969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b36ef176bc75c66cf0c5588b4a8b1c2a1b7d232810c66cbebf83a493e41fdb4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a89dcab0ce7273dbbe93c85a426ea5aaa2d7d8e7be9208b9c97203553f59176e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e69b0472d3da1a6709fbb2b966af2081bea42be335772db89cdc2f0f803700bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e2bd75af16f5da56b7694b46201aaec11a1743acc4a30517e020eb48f2bf8f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 535c7b6c943517f580b504f2612d30204d3b4f160c2d2a66313e72f2bf8e390b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46d66ea099c7d463471dc8e9a9c80857b29b7d0fde0636bbcb5512a9b80ab107
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c360b7e9970f2bb365c6efce2d7d3c706c9ba8920bbd5c84a3f8f857949228a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91fb7b87f6d815e60104836b8c491262c122124ac21fccae48e203f90f4cd984
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f86fb8beb749e7f185471cd16fb20e2b17d7434ce91184a953eea20deb623da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d30f7b95b2e9475978c7439558d224b3adb2ea21652579ae4f732eaa1919532
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d34a21e8854a67be146c736f232df1b5f1258dafa4e70d11fde7cfe4a819aabc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0135d021b0376841cf9e563db7f4a658e093e4542fa6b11368459ad130723db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cab1a28ce9a0fe87b19a1dc9b21c4624f947f38cec7cba52d5545b07bc6137d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb971b06c225f11e9fd6165c1d49cd7a15704379cade432e549580abfe151a7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26d9773bf625dba5c47828aad2057f003c84d5ddb24960ccb3499a83c9507563
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3efec5e76aef7d2944071e85ea23b29f365f5f09432121c524cd35229dc38d60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffc2bac0fe2b5a27d2bf1ee78d7f694b0f769e580c8b2ce9ceb79cb9c4f78c1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df6f04f8c29e6f51260961df77ecb2a395c24fac16fafa9e75b8919cf73124cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 164bae122251dce598021d85ef4726627d237917a5685b910b3cbe3bafd32107
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d986a0ace86dffa3d5f69a26a62c8e6b1feb34ace8bb509234774f4d7e8ea741
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3d64fc0606f0c10ed33702128ec79f39b5de254c3a0535ba5a34f05334d0474
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2aeaaf34d950cce0ab7f7f3fd5d22de97ab43815fdaaecd3ff005d2e5ed1187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 826a50e28577fc607644a8c0159c6cc3f918af1fff76199e186ae492f728052e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 669e09b76dea3847d047c9270f81c4262d4719048cbac3ddb45ff5c97e5feac7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ac7aa4b4a6cb64dca66217c9e035cd4dcd405fff13a695729f8f924d1c19967
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9f6ab70f7ded0056c851607e98ae090c7d2b7c6a227fb6a0394ffdf69d9e8ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79793d531531e48a70912ba4e315e6bce4a395fb39ce1886336e454d8fee9e33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ec907e7e012e3d5b3cdd530e55d3ed1d05548cc5dbe848896aa81725f541fe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 607285f45f75766ce9c170c0e279062b4f006a5fdec4a1772d9eb80d916e618b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f0ee07e26834168f0f2b59efe0057d0e5ef70d394cbea00e3366d73667d0027
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d802a693cf0256e351232009b52b21e215a741b15b441a00abf09a05ce9ce822
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95c2692e8d38bd72e250358b68a8f56e006e3b50a4c2ee3353e0cd03f8591b23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f353878f627638bc847c72640f5b609431af21e2fed88ea6c522389ad2577dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21a751315d9051cfe68da1c47ae21f54b658ab0e71c58acc6723059130fb73ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b126d00ca8170193bcaf61f206c995d2987d9df71a1863390c2e3a6175e216d5
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\install\server.exe
            • Size 324KB
            • SHA256 b5a5df3d2949802c406d42868528d3269598765a1e8ebf8a8b401d9aa2004cb2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/2668-99-0x0000000000400000-0x0000000000409000-memory.dmp

            memory/2668-4686-0x0000000000400000-0x0000000000409000-memory.dmp

            memory/2768-104-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4708-68-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4708-2-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4708-5-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4708-62-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-101-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-86-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-67-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-108-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5080-65-0x0000000003F60000-0x0000000003F61000-memory.dmp

            memory/5080-70-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-81-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-72-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-66-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-80-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/5080-107-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-83-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5080-7-0x00000000005C0000-0x00000000005C1000-memory.dmp