Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 07:51

General

  • Target
    jaffacakes118_69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b.exe
  • Size 480KB
  • Sample261002-jptrxazwfz
  • SHA256 69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 94.120.40.142:80

  • 94.120.40.142:81

  • spynetbitti.zapto.org:80

  • spynetbitti.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:6000
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5564
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:2608
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:3840
          • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b.exe
            "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b.exe"
            3⤵
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Windows\SysWOW64\system32\server.exe
              "C:\Windows\system32\system32\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5464
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 620
                5⤵
                • Program crash
                PID:5476
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5464 -ip 5464
        1⤵
          PID:792

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 cd49eeee1184c692b1970ef82817a53845f5c550bfd540475008b4ad446b17bf
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 3254a04a28df93f82dc86e701f120d6751a7412d8e379c6296d3ee24a9fe1087
              • MD5 SHA1 SHA512 SSDEEP TLSH

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfa4e2018dbe34c8ff2e0d146569b125e8d7dfa381fdcec2dff15c6c5dd07e32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60248b947944f830b43973670d5d3d40186c73a66ee97fcdd7027203ad8038ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bcdec2f44295c23199a92cb4a059ae227eb9b459b41659843ac59de4e511c82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 158efd3c726e51902e7968d6432432ffb6b05ff1952abed948e6949a6a05eb86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23f702d8fba79e85290b4c5dbf9e7e6aa5056e9995d3c9944999338291da6c37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12788a5aeeca51fd173b05ba14675e45e5426f6dd0e2cecc7c7ba30a4e14496f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2c9a8e2e67541fed7f04f4f6a387d59c778bc386fab192a38182f2fa919f6c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33562f7245f2ae41b5568746a9bdd7c8f9d5ad7564e1e5f96c9af547d75272e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1208e2fd121277f3465fd5ba9d897577eed58beb73d3aaf5a7447fcfaf2c543b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7634af25bf348e8234c1d55f0076a82ab25455e77f18041da50c07f478ce4182
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34a67c18e4d1e3c6fde8d5e503968ae027bfc250b930f3bc29bc29f56028fa82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d281ef54b506bd40e8e275917a2457d77603e0964a7de9339a5e48718f8e1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea09f2be24eb678d6fcf66bdb26dc269eef1015d8d0d1d40b7d32245d8b8ae36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6b87877aa225749e4691d75dbcacde0613fff06f9e713a7e0f6701100b20970
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f92ebae39cf5c0cb0438595dbf7dea7b70bae68089e361a9ae74915f80f9974f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 730fa91d4c3769bd19ff5997b2b58fb6df5b549f70b1a73b1589e75224cd25e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 818f39b1078495b1e771f39a727159be84838bf6be94d704e060235218afb08f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfb73a87a153e67318cd83f3156dd919d1d0b326b63014996a1abeddd6507b6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac6bd1b0223ce97761ccab45a948cafe517c322df210167b1a95aed17d7fb04f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b70eb301f7168596a24fe6a967c0d119b846f1aaec5fd123219a811d05e5bdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa6926d95a34d5185b79b3e5b3d7333c5d34574ab9383d07f57a1fdc36b2375c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9175c6707e2793b3a8abffb3d5abfa4699f4cdb108779177b4b323dd3330163
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3edffae35c1da2db4c75346338f7c2d913d69ec35f69ffc11cf9bc5aa2d124b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 869a3d35473cdc23ddf945438b56262c9441fc5f497ccb49e9c65aa60b62210c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff605cf2847c4d9305a64cc03b8b157a5f74eb7462dfdb4f0d490fc1078d6417
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cb817d38b4e36be690b9fa60d4df30d81f85b4e1d53f0ca647fa5c9b01cafe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bdcaca37e998dfa5bfb6aef12c83bcaad12c41ec0ed3ed6d074dd592871e89a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52c745c0a57a51b07dfd58c2a5158caa1ef645c58aee8a313b311afe93424412
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da12f900c1b97c9ee2808fc40616aeb0aa8d1e9984575d1df2f28eb7968df2fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70330311aba2e0ebe981f6ea3c658a45f2268a4c7c8dd3cb92f5b61cac001f11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9da960bc967d243fd2657d208394a1cacda9ae1861a2bd28812d3f546ac139b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4cbb8006a3a830a7e3ce0abb15c68ba6bd666f2566fef4cc6287dd2d1b83610d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4b80ce357d2763af0d91087cafac8ad20ad09ba4ec2cf98103f3f7bba4b5adc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94dd55aaad3995ea41b0a26e511b382d11d1c318fc388a6249f42bfbaf9f47f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01fdc9e5a22f18efa128c6c5dbc7e4011d594ac913115fddc728e617d94cbcfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 868b8ec0f416f4a28435e62eb8532d59957b8473dd53dcc15c9f5055d36a60d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3516eee6156f4d4d6f0f69ab26a2867ff5824a7c360df90bd7db80b059b7d675
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 101db6af0548295b0898d6fbf3cec711885b9813bb4072c0e76562cbdfc58235
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56ba1e54d4ba95af33d14032956212066ab49e9dc6715c32febf887c9b9ceb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c445f85d8e904e7ff2ffed7d30d9074f5ea7f05d9278a5c0580270cef20319c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b6f6306a7134fea7d6850122d87c82b55567a30553ffe7a3f41659e5ad33dc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a212a369fefb8f2790bb20cf370ccaa24eb0f7cb18e559a8255b4bdcb611a45e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26e1469d4d25105b5e12a398e5f56de3e8ae27bb46ecd8c699928e60d6f245b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe8ba8bef062f323277e83ac031d11d41d6c238e962bbcbb82d91a84e30b6d40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c526e4acf4354e0058fc2e61081c0483a46374cd81bd4643d7534bc034bf671
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3b12b8ce155e0ff94ddbf91d52cefe103b77c68ad69ff9f0a9a781d0ceb0811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc2babd94e81aa59f5323f339e4483cb6f3fa4b14fdc0df1128de2f73d85eef2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e20913ca4045fa7c70890c597464e7a06a5dab49803df72365aaa5ff258b47d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4dcf14ff3e18f274be70ae8dec59a6f3208cbdbc80d35d77dbdc8e6988a11af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d35b74a22e71208efd2d796c99bfde0d2a70ccc3d6fbd9fe5d30d8e792da3fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2ba1fc1ecd6721c8be5ec1eb7d86007fef946d88115cec7961e88926635f9a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1712919a1782329f7f26db557b554f6e024055e1fbd87dcddc76625b2ebf92e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b916844bebd49c685feba7a7262d83d75fc22ecadb0f6561b8ec5d39b9fb5e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8c4a53bd07111ea041523bc3ed3b495c7f6db1bf6be9c48da03ab4cb48029ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa54f7a816c8e9484f856f968014cd34e7f99f47e156e13172e66270c4dbddb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f48611edc3ab50607ffc815a4b7e36af1b3a612df522a946ff3308e482246734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70263350c1f0a90f1dda9baf36d0879e307640bbe62a114eb8608c15cc3a136e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f55e78aa262f59d746fdb84c2c8ca3e290a9e07f5efd60468de79cc6e93beea8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48e2812bc99cd1cb5f38c8a71a7d184d71d1eaac9c853e85d02bba4f454140db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dacd1325dee9ef8443d84cfb8e45bd178d90909366afb17a59f9cc6a997451b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c79fc9e3c40926fcbc29904538666f2ac747668b062f5c7b7ade2b60010674a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fc827fd207592b7b40a983d0b8ad24cb4abcd5d06a924e8f07585ae811dd4ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4a515ddf4f8ff2e17e6d592ef3a7ee7589449435b8e86cd85e5c47f688b02b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dbeddd89b151f5a1f193ba71ba47cd1ccc8a25f04cd3c220d51e0d5d9c785e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6b21f4a82a6f1d9c654a931d9ac55fc3e013e7ee6cddfaafe7204555a30cbd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2aedd53162fb961e72a50031c9bead1283977bd711fc194f5079dfb581180b84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fc23526a1eeff323477f20a306b9f43db90a5e1e3d55e2a8707197c8fb0d147
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dd364cb92f56b4712d80b1574e80cf9643ae4cc9c77d359721d83050f27e3f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ad99fd0de70eaf895e50d830a45b049035333a306a76a9248071033fca2e5b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b81f303027b1b546ba45ab3e7b0621c8ed10cef00b0356b77f37c82b631414e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfc87ddafa4c6251604e38edd5c615738d14ba9fe5985d59c8a53ee0ad2c02d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f8f4cdd3aa4043060511cd4a98b706da0441fefd9db6c2f73a9a22869669e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03de4b6f1292adb1240f109e1f00ec254df8c7524977a2d7191dcb189ca48e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2a4dd0b6bbe3e95a57555914fa33a7cd83f2ea5c65038824c678f6c68bf9acf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccc060ca21e3014c08c09fb2b3ff100409164b51b750d9f99100e0f7d659bb74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 132ec0bd3fd2d3538abe979fd5dc5548fb5a0518c0368fe209262e14a725c8d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b7a375c538e47e025f6299971dd4ce14dc3a5fd8a4133203fd1f29ccb61765c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 646c95effaf6bea3d0502b3c23c43ab90009b85132b78cc088215a1e227d5641
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a62b43011c723d5e8a1aad67f6769fffe1bd5a7ef71fb3be3b809504a83ba52e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f031859add880d390ecfdfd58cfc2352e255bcb1dc689206e0f16a62c842738
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7cd29e69a6081688c981c6b05477644e89bfad98eabe4f49c92d5837cd46928
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c96bb04ca1eef1948d80a51a0c1c70b625613885c33b6fbc40fbe6ca4fb1496
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e3695756133ae467d50373917087f2c0880392727366281315e5a1877428622
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bb2419816762ec7537a1298a181a292ce2bb6d239d989ef3b28a69d39aeffbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a99675947791f7237d802413f62f5d2a69d5c1e64cd2635c22d69f982b053932
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f83a757e311b8930e08975d5a8b8f62422aa1503980dec5f37baf5795562b97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9c58a5d5270614e9e215df23b7d095a4bb447901a599b3976d3a356082afdb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f7aa03ed171beef4ec7872074731c7ad58ad09498a19bedfdf1c9c07975026c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b115700cdd95d101c90997de0d01d1925393a27d0b24e12cb8faeb61d2a5a07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e3749f8e6100d6fe75bc92c36f2d3e1b994fd33a2102d1a6cfca9822a344584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 356805e8dd89737f6ccbf88b2d84d33a8ec90c0f0f786b851ef8f68e603380cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66f3446f11b848a26fb5059ebe859112cbd027a6650acfa7da8d3e55a7c9b176
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10f193b6e524236cff62756e3bfa52729c930e37450711a70c4b68b246230ae5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dff24518646134ba890bd53823d88e7df5bb6e13e214f3ec870b2a39cf6bbcf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 066a1167fa096fbc74e88f41dd0944e91916f567208b5f3ffee99c823b822779
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1b3b1ec212ac5413326b8867d51ab28d851664225a85755301764165d05e990
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bba65135d3cdfb083c0c77b741ca2cbbe844938b765a59d45d7e25c9aedf98d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 971bbb6b2b91483c0e723509baf4163ca5d0f747af50635328febe8f15e1db3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89ba0a248b1d174dd45f39340154ffddca07cbbd663c64d6e137850f2ffe3321
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20f5f99efbaadac1c679819be9c8af2c5924c90c94f526030f5083c3cfced669
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8db01b1a99195c3761e366ad7d9358a20af1029592452d4395e3f755d530ae66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d2361e1c45d6a8fbe14721a7e9b0089b07532e42b74d6888eddb75c93ff98fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ceecb5948e46e216c95f107dc310a31713a694cb5711bdb7e92fbd617048bccf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfda9af4e8409f913c3d265d20ad1e4f67b1b65e6b0b451682db0ef5cfa3432a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44d0f025159e5f865ca886b1d0de83d9db52204ee8214c229e9ffb94e83b0559
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0703bce4a45b6cfeb6351c99671d8958094df50d7950ed39713dcb595a488fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28a9db6cc7324d720c082af6c61e54483686a5351a4c3a7cb1e1965f3f3bd864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f38f436c2b3dffeae7d4fb4ffdfb59efa3c84965f71c7836fc1dfb30080ae349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f98a14a42b5840cf17c304b9baf5b0c980cfb1393698764303499a861c5748ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d9382d43b9fa8052e4ec8c517d0dac3db5fe0d2d342f450b442596e75d8f3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 437b52e36fed243f9bdea95594abdad81a64d0e98bafe9cf35220e4d525f0e59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14c9227f043c723a27917f020644ff1234ebf93241db7763bc6fed580af41119
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7f1817525eb2ef20a6c9840e9a910655385584cadff0705e5db26700f10627f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d75b3ddff93f9dfdd52442a4539dbc322c44edbaaceb6d1519c2e1e563b466d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa8b0dc96a4f26f7b20025f463b9b1559171df84b1d213d2bffbf5f7141de1c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4d9bc69fe029ea70d75b92fade2f292450d49313c715695a2ac774c1709b99b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 503c37e7db2f8d4492489fc680c6774ecc2820b4c144cca015db15e8e69885c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26982bf774476f37eb034b2e1ce5a492fce963ea90a96c280090eb0d39787683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ced4c6fafebe6f8847844dcfef4b7a099294b4acae9f5bc0804d3ccffe841ce8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc314f6a73edf6635cdfb20bf23616e75b135c09677682e75cf00d065536024c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5622c5c0a74a4f3bf06b40e230a73b0067d2e5f43766908fec6200f34199abb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 078ab5cb2345067369f0a9f38fe0bfc37473ee5d055f22d2eb66dc22997eebe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4d555cafef7151792a33f10316aa7b8166306167346c6940883424dff77923c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b317d151f682525cf2cf8b92dc6fa02407fea90f3b78072b01662fda85b61512
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50a0fb0b9be772a54bc27111cbc4b7f646a62f759990a77209aab5208a249eb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cdd531635b3738511acde9148c13117830e973c759173ca3ffce83d61b2a3167
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16351fd901cc2bd3d02d2f4ed69e46566fc16b25a477452244c59bea7ccad225
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0afd32858f0c97f7b7727104a8453422ba13f10259196973998c2c83dec62a75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3065251e571df559a577ff46d303fa090b550b951832e9b76793035adc0521ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a55eb21b3c2848a0674a67b7920f48e8b3d681411caaed6120737297a805f554
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 436e373272d4b581d72c4b5be3c41509059ae891b68c6063efab0400bf84f5ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b15e4a884fe11f783e966e081bc9318f631cd23d7c6b9ae0eb344e4771874ab2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd5b28224a383377417a052dffa9bb89de99bf762b3b9a6da1fcb0baef37af72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 590beda108bfd312262c625e665f42ac3817622f0b28b03e7b587a695cf17047
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1c393468c869d537e8e8246c8e2c88b63e60a6723af1407fe93b07873716eca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f39f5754c181dc695592b585da3b7b38f4368cffae9a8cf7c75f0dd561ad91e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95ea1c0b3cebe05ae9fe44d69434d4f2f9164b1e64073184132c95aeae244e67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6e43f6d3f44762ec63f40d279cad97f0b78ae2cfe24a5e36f6b1c57aac0ec72
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\system32\server.exe
              • Size 480KB
              • SHA256 69fc700c7c42dfc308525739ba1dc17abcea440ace6d88622cfe4d64e7a3c66b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              memory/2608-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2608-158-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2608-65-0x0000000003B00000-0x0000000003B01000-memory.dmp

              memory/2608-66-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2608-6-0x0000000000190000-0x0000000000191000-memory.dmp

              memory/2608-7-0x0000000000450000-0x0000000000451000-memory.dmp

              memory/4300-2587-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-135-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-146-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-5650-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-159-0x0000000000400000-0x000000000047F000-memory.dmp

              memory/4300-136-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-137-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-160-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-2260-0x0000000005250000-0x000000000529B000-memory.dmp

              memory/4300-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-5654-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-152-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-2589-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-2261-0x0000000006760000-0x00000000067AB000-memory.dmp

              memory/4300-8714-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-8712-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4300-2262-0x00000000068B0000-0x00000000068FB000-memory.dmp

              memory/5464-157-0x0000000000400000-0x000000000047F000-memory.dmp

              memory/5564-1-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/5564-5-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/5564-62-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/5564-69-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/5564-73-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5564-130-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5564-134-0x0000000000400000-0x000000000047F000-memory.dmp