Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 07:50

General

  • Target
    jaffacakes118_d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45.exe
  • Size 291KB
  • Sample261002-jpc46azwdv
  • SHA256 d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • tarek777.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3280
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:2940
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:3784
          • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45.exe
            "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1456
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1232
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 580
                5⤵
                • Program crash
                PID:4036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1232 -ip 1232
        1⤵
          PID:4972

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 2bd2d1b11a27ac2caea821bcd66d6ef0233aa007af8d4b7d4b138e7ba53481a1
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 80a4f805d03d583a8a76a6da61b9989854f9d8c59be3c5bb2111e71bc34a6d32
              • MD5 SHA1 SHA512 SSDEEP TLSH

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa235db15004014ce6e2c3dfd9feedb9e5a8751b44d191846e190ba06409d721
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a30ed8107ef52d85d70551da9fcff11a687f4536500485b23bc38d0fbaa56a66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bcdec2f44295c23199a92cb4a059ae227eb9b459b41659843ac59de4e511c82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9067d3fd734c9eb13cf90c76890f95a358b7f173cab7d1754123e60a6d09709a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9078634e09bde17607b1124965298504b98940851361a829959e0d614591c086
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c34ff3bc1e873fa8653a80451c7aca4c7c79c056965f17e3d70f8d206bb44b14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4792345e99f2754a245c619f91ab507ae2a4b74e0864940e743f8e68dab6ba87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa7444ed20af0ee212354f332d740a3f69c3440249a2ec06a9884b6783363e99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b60960a035fba2f611102fbc2de7c061febbe08f5b635b93c32c3fb61a800d10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9fa3460e090f5a18a7168c6e1d1870fad6e2a4a493ac9c4134b5090c6f6c994
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 843133588952fd067b0ee1ad5900f5121b42812750b3531e76c261d14eb7a1e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ba8a1c53a7a8bca2d2dead2d6a0fdd02970ef0d337338d02f1ec62ce061c1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8906405530cd9dc8a16557e4aff3272edabc1bc8d7873b999ea6019881c61965
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a21fa0d5b5cb36f8e30b235da24cebd068c48e0def8103c8dcef05ca60386506
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33562f7245f2ae41b5568746a9bdd7c8f9d5ad7564e1e5f96c9af547d75272e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b706cfe100da1ba197ff11a18dbceca3d5d528dd9785a6ab1e465b7651b6afa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5854d51a1a64e4427b7017b83c7cc837126db4724b4ef85cb37ff2ea9a7923da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1208e2fd121277f3465fd5ba9d897577eed58beb73d3aaf5a7447fcfaf2c543b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 945ba4ffac278a372019fbfb224b0b3955c35c57f47c533c6ea889361078e264
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fca0cd55b7f76c7ff93152d5bf120378de0835345fd8ca1099fd7349679ac10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b74222935709c75de7cbeb0a13340019c1adcfa4aeed06950b33513ebac83127
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 818f39b1078495b1e771f39a727159be84838bf6be94d704e060235218afb08f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49a05713b98e55cd6ad05c7c47b5bc30503e1698d52569ca41808e3f568ff91f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 581a058fcc9961c9c959602cb6a90ba95a4fede04f8067e00ac6f74da75b8216
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ad99fd0de70eaf895e50d830a45b049035333a306a76a9248071033fca2e5b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb344c7f809f6894aca96228032be62cb79359281b29f7bb12e0a95507d51633
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 431766e0110d4fb3c6e9fb951adddaa96dbd8d7ede0d3adb30539ba432c418b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 869a3d35473cdc23ddf945438b56262c9441fc5f497ccb49e9c65aa60b62210c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89beb36b994b254045444af6fbaf1328d755f0e632172831bacab9cc08b0b706
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccc060ca21e3014c08c09fb2b3ff100409164b51b750d9f99100e0f7d659bb74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22e3b9d45103a51530db19b04fdfd68c50f1a591922b4802569b300dc5cd70dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f31036ea5989c524893eac12639dacc762e664d053e1ce9cf1aea9099a95b481
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9afd3374082af55ee456b686ba881eba17c1aa9177d6105715ce12d3c1923c19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3a793bc281da8606ef6907ddac203d204ef41ebe99d9252c4ac788c48f649cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 646c95effaf6bea3d0502b3c23c43ab90009b85132b78cc088215a1e227d5641
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cdb6e14f81d5ffe32363ae1b950c92831b8a71331328c2687a482351b6f725dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0f4a3fab52bdc21a28abbe3a62ee6113dc24048c7724d9d98188809ea9873bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78e903e401e3fdf6b46cb394e68da7c941a41b72d1509fc1af2f87fa3ed6993c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30bd545594784457e5a27b673fb329daa48e7cadfb1440ac5c08ed75f2fa6ff7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7cd29e69a6081688c981c6b05477644e89bfad98eabe4f49c92d5837cd46928
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd49eeee1184c692b1970ef82817a53845f5c550bfd540475008b4ad446b17bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a288c14a76a98e790e5f3d11c5909c6c3ab5dcc00502b4b2dcb454085c415d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f92ebae39cf5c0cb0438595dbf7dea7b70bae68089e361a9ae74915f80f9974f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 200d42a60370e9af3744eed98ed52ccd69203dc97a4f9cbf818ac68eb2f0df1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71ad4953732808eabf964a91f0ecbe7fccb147ea9c259d3ee81d4c2dd6151abf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 548315f1eb94996640f37cf52866939a81a04ecf9137d3a92423c403ed1f68d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 398484ab4e37062904612292955855f20fd72234eb2506eaa3e7f6a697700e30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39de4a06a80d857ab7911b2678edc81120450cf94c53c9b0c9a2ff198384e745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7eec792a49592934f3e32556f0344954465492291a89cc50928be9f31d303de4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7704c783c785c7f55038c8a8d7a96e50c0c0bea220600aa10914b32c32d1095
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9d7db8f6b5cacc857aead26f0bd88a5fb55ab18da8a663e5f6bf65a725d5cca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56ba1e54d4ba95af33d14032956212066ab49e9dc6715c32febf887c9b9ceb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a109725cce45dc124f7a6b009e73ce05ab6541d70a0e03ae3fa3d7a96cda615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97fbdf1411efc4443a362e51d5da3953af6bccda76d8fb233aa1f8b080e0f979
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33ad52d01f784705045473773818725df367088ee724fed579393e2b1d4bbd28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b70eb301f7168596a24fe6a967c0d119b846f1aaec5fd123219a811d05e5bdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a5acdd8bd4848a5c1f452b1475cfab689faceb356010977d2dadb3bbd65b777
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f1ae9252d7b6c863a5a1a5bc98729c8c64c4e7777f187dd3cc0db324b6fa260
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3b12b8ce155e0ff94ddbf91d52cefe103b77c68ad69ff9f0a9a781d0ceb0811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4dbd6e424ff827d37662073ed28132e1b031d3d679ec2abf82073de68baa2201
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfa4e2018dbe34c8ff2e0d146569b125e8d7dfa381fdcec2dff15c6c5dd07e32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff605cf2847c4d9305a64cc03b8b157a5f74eb7462dfdb4f0d490fc1078d6417
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60248b947944f830b43973670d5d3d40186c73a66ee97fcdd7027203ad8038ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1712919a1782329f7f26db557b554f6e024055e1fbd87dcddc76625b2ebf92e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 158efd3c726e51902e7968d6432432ffb6b05ff1952abed948e6949a6a05eb86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f48611edc3ab50607ffc815a4b7e36af1b3a612df522a946ff3308e482246734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12788a5aeeca51fd173b05ba14675e45e5426f6dd0e2cecc7c7ba30a4e14496f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4b80ce357d2763af0d91087cafac8ad20ad09ba4ec2cf98103f3f7bba4b5adc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28a9db6cc7324d720c082af6c61e54483686a5351a4c3a7cb1e1965f3f3bd864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da12f900c1b97c9ee2808fc40616aeb0aa8d1e9984575d1df2f28eb7968df2fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2c9a8e2e67541fed7f04f4f6a387d59c778bc386fab192a38182f2fa919f6c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01fdc9e5a22f18efa128c6c5dbc7e4011d594ac913115fddc728e617d94cbcfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfb73a87a153e67318cd83f3156dd919d1d0b326b63014996a1abeddd6507b6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d281ef54b506bd40e8e275917a2457d77603e0964a7de9339a5e48718f8e1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fc23526a1eeff323477f20a306b9f43db90a5e1e3d55e2a8707197c8fb0d147
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa6926d95a34d5185b79b3e5b3d7333c5d34574ab9383d07f57a1fdc36b2375c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b81f303027b1b546ba45ab3e7b0621c8ed10cef00b0356b77f37c82b631414e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c445f85d8e904e7ff2ffed7d30d9074f5ea7f05d9278a5c0580270cef20319c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfc87ddafa4c6251604e38edd5c615738d14ba9fe5985d59c8a53ee0ad2c02d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe8ba8bef062f323277e83ac031d11d41d6c238e962bbcbb82d91a84e30b6d40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 132ec0bd3fd2d3538abe979fd5dc5548fb5a0518c0368fe209262e14a725c8d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4d9bc69fe029ea70d75b92fade2f292450d49313c715695a2ac774c1709b99b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c96bb04ca1eef1948d80a51a0c1c70b625613885c33b6fbc40fbe6ca4fb1496
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52c745c0a57a51b07dfd58c2a5158caa1ef645c58aee8a313b311afe93424412
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a62b43011c723d5e8a1aad67f6769fffe1bd5a7ef71fb3be3b809504a83ba52e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8c4a53bd07111ea041523bc3ed3b495c7f6db1bf6be9c48da03ab4cb48029ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34a67c18e4d1e3c6fde8d5e503968ae027bfc250b930f3bc29bc29f56028fa82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4dcf14ff3e18f274be70ae8dec59a6f3208cbdbc80d35d77dbdc8e6988a11af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f55e78aa262f59d746fdb84c2c8ca3e290a9e07f5efd60468de79cc6e93beea8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f83a757e311b8930e08975d5a8b8f62422aa1503980dec5f37baf5795562b97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9da960bc967d243fd2657d208394a1cacda9ae1861a2bd28812d3f546ac139b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26982bf774476f37eb034b2e1ce5a492fce963ea90a96c280090eb0d39787683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f7aa03ed171beef4ec7872074731c7ad58ad09498a19bedfdf1c9c07975026c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48e2812bc99cd1cb5f38c8a71a7d184d71d1eaac9c853e85d02bba4f454140db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ced4c6fafebe6f8847844dcfef4b7a099294b4acae9f5bc0804d3ccffe841ce8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4a515ddf4f8ff2e17e6d592ef3a7ee7589449435b8e86cd85e5c47f688b02b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6b21f4a82a6f1d9c654a931d9ac55fc3e013e7ee6cddfaafe7204555a30cbd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2aedd53162fb961e72a50031c9bead1283977bd711fc194f5079dfb581180b84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b115700cdd95d101c90997de0d01d1925393a27d0b24e12cb8faeb61d2a5a07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 078ab5cb2345067369f0a9f38fe0bfc37473ee5d055f22d2eb66dc22997eebe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b6f6306a7134fea7d6850122d87c82b55567a30553ffe7a3f41659e5ad33dc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66f3446f11b848a26fb5059ebe859112cbd027a6650acfa7da8d3e55a7c9b176
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4d555cafef7151792a33f10316aa7b8166306167346c6940883424dff77923c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3edffae35c1da2db4c75346338f7c2d913d69ec35f69ffc11cf9bc5aa2d124b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50a0fb0b9be772a54bc27111cbc4b7f646a62f759990a77209aab5208a249eb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cb817d38b4e36be690b9fa60d4df30d81f85b4e1d53f0ca647fa5c9b01cafe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f8f4cdd3aa4043060511cd4a98b706da0441fefd9db6c2f73a9a22869669e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bba65135d3cdfb083c0c77b741ca2cbbe844938b765a59d45d7e25c9aedf98d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2a4dd0b6bbe3e95a57555914fa33a7cd83f2ea5c65038824c678f6c68bf9acf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4cbb8006a3a830a7e3ce0abb15c68ba6bd666f2566fef4cc6287dd2d1b83610d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16351fd901cc2bd3d02d2f4ed69e46566fc16b25a477452244c59bea7ccad225
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 868b8ec0f416f4a28435e62eb8532d59957b8473dd53dcc15c9f5055d36a60d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20f5f99efbaadac1c679819be9c8af2c5924c90c94f526030f5083c3cfced669
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3065251e571df559a577ff46d303fa090b550b951832e9b76793035adc0521ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d75b3ddff93f9dfdd52442a4539dbc322c44edbaaceb6d1519c2e1e563b466d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44d0f025159e5f865ca886b1d0de83d9db52204ee8214c229e9ffb94e83b0559
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 436e373272d4b581d72c4b5be3c41509059ae891b68c6063efab0400bf84f5ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd5b28224a383377417a052dffa9bb89de99bf762b3b9a6da1fcb0baef37af72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f38f436c2b3dffeae7d4fb4ffdfb59efa3c84965f71c7836fc1dfb30080ae349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b916844bebd49c685feba7a7262d83d75fc22ecadb0f6561b8ec5d39b9fb5e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d9382d43b9fa8052e4ec8c517d0dac3db5fe0d2d342f450b442596e75d8f3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b7a375c538e47e025f6299971dd4ce14dc3a5fd8a4133203fd1f29ccb61765c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14c9227f043c723a27917f020644ff1234ebf93241db7763bc6fed580af41119
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dacd1325dee9ef8443d84cfb8e45bd178d90909366afb17a59f9cc6a997451b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fc827fd207592b7b40a983d0b8ad24cb4abcd5d06a924e8f07585ae811dd4ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dd364cb92f56b4712d80b1574e80cf9643ae4cc9c77d359721d83050f27e3f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e3695756133ae467d50373917087f2c0880392727366281315e5a1877428622
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03de4b6f1292adb1240f109e1f00ec254df8c7524977a2d7191dcb189ca48e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a99675947791f7237d802413f62f5d2a69d5c1e64cd2635c22d69f982b053932
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9c58a5d5270614e9e215df23b7d095a4bb447901a599b3976d3a356082afdb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bb2419816762ec7537a1298a181a292ce2bb6d239d989ef3b28a69d39aeffbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e3749f8e6100d6fe75bc92c36f2d3e1b994fd33a2102d1a6cfca9822a344584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 356805e8dd89737f6ccbf88b2d84d33a8ec90c0f0f786b851ef8f68e603380cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dff24518646134ba890bd53823d88e7df5bb6e13e214f3ec870b2a39cf6bbcf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1b3b1ec212ac5413326b8867d51ab28d851664225a85755301764165d05e990
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 971bbb6b2b91483c0e723509baf4163ca5d0f747af50635328febe8f15e1db3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f031859add880d390ecfdfd58cfc2352e255bcb1dc689206e0f16a62c842738
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea09f2be24eb678d6fcf66bdb26dc269eef1015d8d0d1d40b7d32245d8b8ae36
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 291KB
              • SHA256 d305e5eaad5a0cbdb51a729d1893d95dc590045ad4cf337d079ae09154466b45
              • MD5 SHA1 SHA512 SSDEEP TLSH

              memory/1232-160-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1456-141-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-150-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-164-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1456-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-148-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-149-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-153-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-155-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-165-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-136-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1456-140-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2940-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2940-7-0x0000000000890000-0x0000000000891000-memory.dmp

              memory/2940-161-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2940-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2940-66-0x0000000003430000-0x0000000003431000-memory.dmp

              memory/2940-8-0x0000000000950000-0x0000000000951000-memory.dmp

              memory/3696-137-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3696-6-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3696-64-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3696-72-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/3696-75-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3696-132-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3696-2-0x0000000024010000-0x0000000024072000-memory.dmp