Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 15:23

General

  • Target
    jaffacakes118_Trojan.Win32.Refroso.bsp.exe
  • Size 1.0MB
  • Sample261018-ssmx7set7m
  • SHA256 d6ae279c829e3c8116cf1853cbc1139151ca9ca1db6eece594b2a4e182788c3b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • birkan99.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe
      "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1368
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.bsp.exe"
          3⤵
          • Checks computer location settings
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4920
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\SysWOW64\install\server.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3020
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 576
                6⤵
                • Program crash
                PID:4400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
      1⤵
        PID:2600

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 6b4137f17166121d7a4b3c3137b23941b4c1fa72584f9339ce3f2cb8d6f5349f
            • MD5 SHA1 SHA512

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 278dfe2c35cef673bfcc4304c741f556f4ed7fe03147bda23a8710a70f5f7f9f
            • MD5 SHA1 SHA512

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 fefd715108c3e3b7a2caa5c54cb526afa4ee04238d3ce6426ef6bd503942748e
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 b222615c7cc334ec03d3a3d0094b84bcaf4bde7f606ec921a0ac4bd9b59fe19d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05c4c537363e497d4f8208f46086f888ff06e5f77fae04a2bd988d603b4fdd6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3b5ad1d347af8dcdc96c02dd31f5dfde85f6ff39c5032c7925f79098da8ee14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f7ddb349d165439bdaf771007db11a9ef04b8ba274c84c060c9c89ee532658e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7831750f48bf370dc08a3c02c3a1642b141e05087fcb5fd673660a642047e32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95fa33c6d54b2a7529fdceb60a005508a55c78be2edb7656bc7aa4b0de52e0ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84ef3a45bae25f3d5775d33e625a3b96cebacd145643f532425dc2d5a3778a49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06141a8403775a9a86ad367a3d67f4adaee893de0faa2aeaa6c3bb64183be261
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db1678432494eafdbeacb5d323f47c0b7d8d71ac9a4e21b50537720d3c0218dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36471596d6162c77ac69f5ab4999b9a7fe6273fffd5e15ea55bd8907863a27b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 819bff456fb8459c4d7156aab5047832b42e32c26744647f51059788b282fefe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e64d915bf04ca066b229da31fb518e5719c689d2ff8f77f3c9680126279d2783
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f1d036290950441e74f8b0d587c577239a0470a34ac3ab643f97ca3c4b582a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90b571f7007b867b3825730ae80245710c9558f0d82e988bd8ac28283cc3cf13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60b7f0c1743cf0a34d67b81d3cede648cfe40d5b9a109c359e0046a91acbfc96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50b64b931bf6435f6c83dd919aea8b940a73c23a4960ca3f3357485e31e0278e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ffdcd626120490831daae02a2925048d05fd34cff61c8db294edf500f3d90c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb1dd1caf55537d88686047975239fc2172e8b247fd89f9a2982fca30f0215f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc627af0c8cf155be13d6e51c302dee8c0e96aade79780525089480ee3ba0105
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0553142b395e76b9f68358671efc2834f369cc1ce733da651371ae39a111c1f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 157c789839e5899bde66aa0cb81e2d98b51bea5411414117472c7f83a0348490
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63bbe0b8e3a4eddb7c26eea580b08b21423a632286a64e9e04510dfb65ebbed8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecf268ae421f044d9eb396b01168a850bd3df8c60b1f5723bb798a95b8a90dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdf7f9a1bde59ca65399e519152375e229e0986a1e543896df392f7f07923e30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9359bd99067a5d30e4762f7d9a2d9f4d10131a56874b66a2b5c58d420160dce6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e45ea19a39ca5a96d9712e9681229901a211fffaf754462b7936dc0d809cc5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebbfb911364eb88e42526672a95ddf7e45b89b0441219edb44a1c9d8d96c5b00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bdc5442278dbfb8b0dde5490b02dd11b4c519cd1e5a719c83fa5c610606ff92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c84a7fddae464aa3b5d1b0f652dafa60f1bd00c0749dc66161bed30e1d4c7a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d37400d2998c458de01617c282d6465db380a8d3c109a91ad02cac3db5fef61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 950018d9a34e1b3c0b2c5b84ebab033fa6dcff4017884a1135f5727c17378402
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c76b336bc86d52eeb57995ac33043feb151f147428f9304db68250ce6ce0dd87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d9f237b2110fcc1e20703d5a8171a382a453dd03514681b6db078ced17fb452
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25e5e8ec92ccdccd608cf53809e3b3763160708c3ab910d37b8fa24a8050644b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052238f7e17ebdec063d34c502e2cc6665cc77b89a677207d8b52556e8fb5753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f77a8fd44d82057abb547325fcfc46291fd37c1d89caf06eabbf56111097469
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 151edc49a00194381c3c6c5050cc58e3668db7ce9ec90cf128f1650b58a3a40c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f900939773bacbfec23c35b61bc862cbe49646b1eeb2f5dcc5527cfc4554f3df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07a3454cd4a64001686896bb6606cffe6e63ac4c5600e86bdc40f94911c1cd7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c24170784c635f1c672493c600c068bf984bf4179d1b37d2fcbcd9a2659611cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a9f47152a1880cd6dc08ec4127538d149aaea2fab9839799ecd1c8a55a063f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c17ef2d4c26dd60d1f5cf291d065702611ae5c7ce47cf113c3c5c4c366817716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 920fe0f2bef6e8e85deaba352bc3892629784509f466270a64cc06095e4557db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75553afb2e86ab71e4b74ea915b8d081a40ead4a5a7096cd96dd04905eb36f8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ace2b87bb1dc727dda9f1570cfd81627ae523670a5f6ce33f97ab97d0d1c19cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78d90cb843e42490b18ef5c861185ed4cbfb7e9ebc7b7c134c52c8ff8b8b0e08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea13e0bc8ed23f771300493d030527436bef9fa85d10c16454e2e9989a1edb89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa5a1b4d8888217c7e89f7071a3000e61e7187aa5d93615c2e037b3abb477c08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff1f7e4081349709701749385f9b65ace1a6c3a0d108f1dfbc1a468ebd75d087
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7e59babc5fb167340b1dc1e07745cf837bf99d14c20ecb77e521bf0cd749466
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6799ffe1bad1d0821d15f589834178ceb72243406548df459e05c21fae00f999
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef8599bce0f82f843e899b0ee4d738c6d554ee8e8379825910aec2c7c57d7687
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 767e508b015394e68604d723dc58d9930034cf168b03615bc5d4ee1ae1614363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1417485ac2f41875adc1f713a7f5effd2cb62e4124ee810495712b4fe8f6080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee12b5ca5797572e57ed61a64f0e4ca569ee0bde1c47a9878b55001311c20a23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71dd845d3d6485961d2f59913d11c2c3d18d87a0d7129095634a78832f9be8c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 036f5bbe8b7e6edc2ebfac34c31d8b8d8c3e40a3cc1b08ca8f0f153cd45cc393
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ec84594d67526e360a2afd9e631bc20e1225d2de2c21d1673f2080e6f054b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 879b1c4ec28b640ba120fdb1668137aaf36414c29d17d248b8c047171602c862
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40bf3c9ede633105138e05efe923a49cf6640941f08658db4b5770b51f2e23ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae442753979843fa99b76835a1deac75097fdacd3acc6e18b0aad3663f4ea9d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e3cf71ff2a5e777a73327c5715f9057d783fd611b752a6a70338d91aa2f857
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a58498fdca09d2f35cca8aaf2daab40e891b3da5e1b755f39ec39e63c3ee226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2d362d5f7d1184822901ce082b5017864458ccccd795c4543debf97fdbd302b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89942dfd0f473f0a4ac5a5fb9a58e28b04a5fb644dc08386c7ea9c102108a8b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b7838b40249665e246867d1d08accbd13c434db53d666f1294e4173f1634f66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40f5fce742c06596987dc057e40a7263dbd93b93b1056ea7e9920c093104ae7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd97921dcca8b8f481e695e665c431a9baa433ea8d68fc530f6c82975e1d8b1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adb5b66f56f64726dfc436514137485750afb07abb0465ca235229af0de1c9b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef017529a5f7747828f2cec8ba7e70d310d1cd72c7b1849604ad64ffe15ae91d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbb25c1bb24f2ad13f32bd302667ad48dad65f447be21d5cb4bbc06ccf6e70cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76ddf67cdfc5d39d98f3a7724aa6ed7b466d714137eae9455780693e5b5161e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf236f071cffd14881d25360a6c6138caff00bf1c9dfddca512d64064481dfed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ba55658202636c06579576d1d7671abafdf9dbcfd1a4affa4216bb101541953
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4d93e3f0b3e8098001ff46e3f9c286487d40d53dc9a3097de573e49b941940b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17f8cf9c10b15a55eec1cb606222c54cc93aa1bf6cfc21fadb6e24c2ac04cb2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 955cf7c2a5ccd67ba6cd5a75b08bee305901560c174f0f61b3749db01e57eeca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c708f38cf57440084770b7b674980df0d292bc1653f647513e51fcc0aa4a30d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a7ff48a5deb7eca5378577024ed77acbe9ff7b1a9d80f555c0c2313073709ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c24b610e70e5dd739569d76243f614538086d7f5639794500d525199adc83b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a385944471a8321fcc567ae392cb9d523b6eaf6e460ceed58bd54c46803bcf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dc8fbe0d3056d5a8aa9763da9f0b46e030e1db7803a09688d10ea6b3dd72295
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f16a3cef257d76b8df42b468927a28b42ad36b012d33d08fc06766db5246af11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2fed5e0c69a8bdebbe8b841c3d23d02d13bee6e483285be8596fa50f4619f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11c10a51f17704c791ac97421f53f9a0a5e1b6130d25b3a077f48026e2730e2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac62b53774b307e2d93bcd4450a41a21795f63954d3c75b37dc5b09d0a2b46de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32753b6e29af36bf4081b43fdcbe75a9f3fc13d0a4c264382e430f33c84bca8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08648288dc8294e2bc4c85b836ebbeace8d19e377c2daa650a18b36db0042c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9482e065a4db97271a830a7569b8e6d06e1c9d5e80908d5e7753662f5494a043
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0babea1ab74e70418011234bc9e60dd2928946944837069f99944b11485193cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b7f2dffc3b0636eb36081a9150a1c053d58521add115e55a5f6572a76607ab3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 573620f30d811e8c7fde9efa8900cacd63e009b6b775d7edc2f8dfb5dea7a0ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bf61c4aeae08cf39ed57ac711cf9520955f3385515fab535a1392aa9636dccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caccad0f45f15b1763bee027298552d33a02be7ff8975373f67ad978f2718aae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 843b54c7377740411da0626912424f1a56c5e5bf06a360e8046af5f829e546b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 771ebe42daa4e912be39649c640f6662e7d87045797294899b16ba2d454e5c08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f042158781aa9bde97120228f7c4aaefe3b9d55e7aaa6096de31c726356734bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0b86e7732b9a8b820b3f0d98de600ae6d64cb264cdede3fddcfea9d100198b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c684d04b80dfd68dbd6f186b52068b2a26e58bdea968ee9f93223801ea1ebd64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9417c003fb77e7198794e629520f9c41f488840896890069693c9784b8fe080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1f6bf4907224f9a4b47d21c549cd8780fbb6ac4e3581e37390666c23778e448
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cd22097fe9ae3a73df3106b1894ac39c7709598f2243c2acc7ac84fb62df9cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2d58dad4dc96d4cf9010a802769ee64284431fe65424f2e933aaab8f96a5626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bace149d9cf75f7bfdec2d7f52ff5889d1dd94fc1feb1e719d4ee4ba45c4b5bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b514dc49746921a2b06801326a446e59dd7b055177581fe21ae11ec591f42d4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aa0e28bedd21f467bfb47770f62ceab22e27028122bcdb37222bf7da41c977b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87beb3d68bb11ef404adeac9bf2d00ad7c23da00ace5c4623fa61472d5c414cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb2af40f7b4c0b2e8367eba31b3dd84c5db350fa8a673abb1ff6d04e2770b9d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a35fa1f779749745c31e6d9b81c3820ce46e48ce13c0144f63ef5799ce4e95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 081ad4504b36c2c320fa3da6d68719e75fa2420f038175753b440a6319435ec0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8594dacf769eb3b7f946938b072fb2e8ee6f5fe7979767419d9e447d77a6e296
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8074803f81ffb72fdbf528afb36397fb9fef3b0be946008af4e79ecfa46ce796
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 030de68f11660fcd448c1a420fb02f63cca462d62648ae60ccf1f66d7a68d326
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8944f2abdb557686959a9075307b13a786c2b6d40e32988dec3de015cab44f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96d0d64898c57903c69b83ded1e0754bde98254f286e4d20d921438ab0dc5337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e3460df018ebe38812323b6be548f4cbdfa3c3f85be8e576021d8e1a6aa13e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 320af74291fc8684f1ef324dfe0a02508d3cf889b3ffba9d04e44ff3d9f3029a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9402126991722e1e7bc0f86a52431b69262f9de654e0060203ba082d19a5b84d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caff572872885995c8e36f1fd097c3349bdeaffae104e414e867ac269252a255
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 018be6511d013d1ecf7d9fdfa239ddac85124ccee6874df3d40f92a05fc89a85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1669ff4081c2b5c7cd4d7afa2fb808d0ef5fe1a895a88d2d2c5b37d1d6a819a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f837deb1c624fe385b8db6a59fe9c2ec99de430740c5485bd10b561d447764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72743dbd79a733632b60ecb24af9368dced6d901f45c3cffcb78277d43b930ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e3ab60f8a1a5166bd27b885bf1eea1b546d065a0aab443a515eab0b643a90d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79251744e95010168d90434f97a08816e2def0e6a0699c050586b1335aa5117c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af87251d44d0db2a51b4f93e3386d8f0b68078b6e2f5a5abf6169195e926db0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3805254bef618518491abbd9d060d17f3ec33c214cbb25b5bfaf297d06a010c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f340488a2a3e752309ff8ab6bd961d333721a86b20c0bec3d8a51b790767b666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13952f00e8fc93ef0ab52f920ec6e1416a85b9e903657756544f40379e09e037
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dad73e6d86af39ee1a5ea83a629ec146c033b670632eba76cdfea95e78bba903
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64e6ef8ed806ccbc82317cc84eaf2700484dfeb27d19659dbac662425ee88801
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22cdbc045fae8ece424e7d3ed260f0fa13ae6e4f2a4aab8f998cba4613b8b169
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56aa8cb98f8d69ae430c2f7248638b97cf7c121721796c4d153f0d39c594481b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 573b056fc4b948f4b0118c8c7a4627acd9a38b5b2bad19ecdb20bb8abfb8fa82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6400dc752cbb92ec0f47968891d222097b1bbf099b6bcf1b3babe6ba98bfea6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a20d5098d7fac686a4bad81f70f2f738b3061234940ee763dbfd373cc6abe38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01258cf616d1949c0643b2e40f6a829d5cff07b707bf13f5c14167d307224248
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05057c87f26a7298b574f1b696c51ae854d1750c333f92e85b3ccfefa137814c
            • MD5 SHA1 SHA512

            699c4b9cdebca7aaea5193cae8a50098_c1752df3-9308-43f3-b3f4-0cd87d6e3e1f

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-939655444-3071939294-1401108526-1000\699c4b9cdebca7aaea5193cae8a50098_c1752df3-9308-43f3-b3f4-0cd87d6e3e1f
            • Size 50B
            • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 1.0MB
            • SHA256 d6ae279c829e3c8116cf1853cbc1139151ca9ca1db6eece594b2a4e182788c3b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/3020-111-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3020-109-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3020-110-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4296-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-14-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4296-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4296-32-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4296-77-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4920-91-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-82-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-76-0x0000000004430000-0x0000000004431000-memory.dmp

            memory/4920-83-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-92-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-78-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-97-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-18-0x0000000000400000-0x000000000047B000-memory.dmp

            memory/4920-95-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-90-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4920-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4920-16-0x00000000005E0000-0x00000000005E1000-memory.dmp

            memory/4920-81-0x0000000024080000-0x00000000240E2000-memory.dmp