Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 04:47

General

  • Target
    bdeb6647bcbf8f94010a9b99ade29692_JaffaCakes118.exe
  • Size 668KB
  • Sample240824-fewa7swall
  • SHA256 33c50032f0badccb6a7ed50ba9040a656fc549dfdd50d8a8c26374fac8f575eb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • Cyber

C2
  • herohacking.zapto.org:82

Mutex
  • 36038524LX0M21

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • herohacking.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3632
      • C:\Users\Admin\AppData\Local\Temp\bdeb6647bcbf8f94010a9b99ade29692_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\bdeb6647bcbf8f94010a9b99ade29692_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Users\Admin\AppData\Local\Temp\vbc.exe
          C:\Users\Admin\AppData\Local\Temp\vbc.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4004
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:368
            • C:\Users\Admin\AppData\Local\Temp\vbc.exe
              "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
              4⤵
              • Checks computer location settings
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3504
              • C:\Windows\SysWOW64\WinDir\Svchost.exe
                "C:\Windows\system32\WinDir\Svchost.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4456

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Admin2.txt

            • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
            • Size 238KB
            • SHA256 fcf216e43a9f0ae5064e8148a5f78c38fa41b450cefc53de795bcc64ec901150
            • MD5 SHA1 SHA512 SSDEEP

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 41e26b6186e46719b029ee724d086dd06dabb85a66ffddd9143770fea890a697
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0d2782d0cf543c7e04abce2cd4ef58d345e9bebcafcd105e6e3d5d224ad4e210
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8e7bc2a8e71f1aad754009c573f5ad19a589105ffeb4f945ba11a25b91117da5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ea0c5dd0b0fb0ca3fc52648fa04c26e62ce23c72de68d96d3670f47fcd035fe5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 13d189c794e4b063f9b68246d2f30c0968b75ac597958ba003e6c4d43ca8f031
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1d94dd318abbd7c61659420d0ccf0f1b92de7adbde191405ff8641b9b4b008d6
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d90582af28876fbd9bc4cd6cea800d3d392026d6a402b2d3c801fc4303e6f171
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 41627a867bd410d45019c81b86b8648ccd92adf887566db4c4c12fc437b87d14
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 265bde5ce157daf7eae6ba824da8c4ed308f909a3607c54260262195d0d4b683
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c87a9d909d8c8cf272d9dc0bd290b2c58947200882982932322fade99188ef7b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 05c8b0a02473f56b122b6e1549754b99c46cb097c92489ed13c29f90ee9ba518
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4420668fa96c9354f41cd2c6ff6740eea5076ae3fdedd4b6437002c2a0f311a0
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f1490b8cca6867f47f585f566161a642f50aa0898c335b4d10ea2da01cd6a900
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 601d0881ae3dc3b9c2b827c9cad2e207d80f3dc5a2a7249a78c10166c32d93f3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2a42b910eace8d15e61fd483b5e7a4438a39ad139534666d3c8f625608d51366
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5bb68015cde60fac85826c7561233d5654af37ac5240ceee1a882b817177e96a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 12a5a8028917483b952e2862c06cecb6dee871c1e062d9365a464acd30ab5015
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b8077122bb0b50398b266b5081122bb53cd7be5c47e9a61318fe058287bdf7bc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4feff1079f863dd90d8cd144830afa120df6f426825ca295f57e1ee1e7cf1eaa
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 256379b64eac39372d4426fca440bc15a79fc2b9936307176cff16b88e45e50f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1f6c90e1c08542bba1e83b53f8681b4514e906f692004c837f09e688d716a9b7
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 7c76e45b0aee1b7b6ff405edea2d4b6d087a60c09fb766c12165c91093d7358e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6914c9ef636c072c47693e29ac086cd1ef09b874787219d5ba7fbb1f214ed8f8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ca1f1c69f91eceb2c15a986aba57b750ccaf6fda80b48a90ffe5c3d8c383d574
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fd80bb3a1427dab29ffbe5aae7d8783b52cce03d536a8f9c37a0e31e9ca6f1bd
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f715f8b2bc94be1beff2832e77c8a3fa09f17f7f3908fed0e346282b1415cbb1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b81ab8cb6cf003bb3aad304fc0d2dee76efdc454677101993e2ba6f07c5da85b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e71c43e059bb21d1cef9a3f946427d4a0b101df01c654ff2ba7af50a61d4894f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8b16425f35797de1f4fd5983e209f47415e43f45db43991f9f23e8659d37f386
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 dd4a58d721a6309b8dee296c16ed8d2cd35a814aacb885695874ed88231a1e81
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 94a04f99c4fb5d73ce5a4b7f8e0a9f5c05a1d2f508a054c0665611aac888f4d7
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0127d44885f6f045a8d6a9b198c7154e42428460b2b589e95f68164cc835b3c8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a4a2dc6c604458848a20a10a138ae8124936bc83fd2306010769b0c34a572420
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 230069e1ba3598b750df598a335de8f707fe156a10a814776e01779a3b93ad12
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a1858ab52379b5cca0c92a6809ee48297bdd94272c6ffba63b996ed9dcea41cd
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 69277b6f9ff8076fda6469a7dcc1693a6ffafdb8588d299fb1f14fb398e08325
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5cf7fbe0ce43597879817b39b2d334515b2bf375d3a3dc9b800ed1fb537904ab
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e8d04a24bfc786ce258a4d6a6b04e53744e8b13e3243545726f717650f19ccfe
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 26c12be85d1bc21c67038a49b9b61106a7bf10d3860ad5dd8f2f3745a4493475
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d8971000c2aefda9878d12bdcc8b18f9b7910925f2476b595a7a915b628cef64
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 76d4933df12f8e835a7e9f5826f7a73f24977c5fa4e548b227c98dd7b8bdc52a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 7b81ada1f46538da48b1989fee0a898161cbd413d38f5585b0baaca3b725a232
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2eb011614c5703734de91daa819529ade18264a25e339df0c7e687812abbab7e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9e9b654dd0db07c9ea3caee61f04b8051114886707d29b37d6be7aadb01f3e9f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 907b2839cb20b51df994dfe0f209ddd1adddc867a0d8a6a6fa49d4db7934cb29
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2bddeae435975961878022a388afb179c6b0daf546ae18cb1c4d8658a4375fbe
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d693f09eb851bc19a461a3208f0f23bc405a7cc39d836200aab7edef23bf8249
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 aba5696138a23e718cc7177ed0f7e36f9e9b76af157299b1d89ce14a9a306312
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a4440b077c3b5bf18fb21244159a819bdbfad09c45261d717d8cf4372f205f0a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 54621c923c59924fbf6169ce95090af244ea2b5cf39a68617272a1ddab8affb2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 031e1d658471a240ece29d2af08a7a0aeed87dd7df282e9f0ddb894e5a50c007
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c48838badb2ee6fee41c5c6a8277f488476746a2c63f22ccbeeafb3c179a90ac
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0ff058d33fcf73ac3048ab69b7298dccfd1270af03f4698546f47fd0a9134d98
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1f461cdd01b128376a3a60b891a46604be899eef3138a7619d3e2863e693d4cf
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b7fd59daa0f636e9da62837f2350f42df8c9799ef9835ec0a8b0abe5bef8e588
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 679d6872788849450764b0b33d2580ed3408e3dc4785d4b722aad0bce3727a1b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 465c69d5dc6f226bc9936543999cbd1fe87e3cda6c0d225190342a39e114f5aa
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 12ed0ca22dd28c555f0765b3a6d4a95bd099a31531708cc84962ec03fd5a7f33
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f7b3d6fed07e96658da62a3fc1d0194018828a1393655464c82413793874f3aa
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5115e65024ff0f225531f06d38b37866a22af6fc4f7d4087636410f959988de2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a84b29700177e7b88e65a8a0c7f8a3a6c572a61a63aba33bcb1007b8f6cb7c02
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4014e23229df56a0e12d6127c5dd8046952e35613cc1f3f12858fb2a017519dc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d6db749ae3a75fd103bf434d4e0c58678c4433d0e998f7aa529a97ba342d917b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 90c4c395d4db89e7243e34534f6f7b0f2e688300c4829860ce19e0e4dac46eb1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0c094b47927ecc00e4c02fa5ac405536dc30cd799b31bfbd4daeeb2f5ec3d733
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c974f593b7fda71a1fcbe78b725f514a197a638b9a1c5ce8049bad4a327f76cb
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0c56d91dcaecb3830c9507cc3c4ceb0419a068e9af5cc95cb3122f7fd568fc71
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e0fefd3120fdc96d101367414c2ca374609e64968142d7de4c0f5c3adcd223ff
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9888a0f6acd74fa317855fd9bf5412c40167f625148efe1e50bf8c0d45c6a867
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6f651104f0758dc12be09f65c397aa1202f08cfea3dfe9618e14918c8fb12da2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1295e466df26da4c62713777134e6af75f51aa8a520e7c6ba8886a955c419e8a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c0e18c340034c67782b17d43aa1f77a6ce2f06c9448442522a8f00d85cb98517
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 735adf619a6c04189d58d85f91ae6a7190f491b712b6d87553adeb3574f1d313
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 01f2c0d519cf6fdbb9891db591cee0b99625e6a582a037f50c75ada58b3754be
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 eea69f7d4140c432f465f094eb7a050efc5b8460d095830425a87e4409397c89
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6a5c21f601dfd108d82c28d17a45ffd3b8b76e8c3d4a1a07f8ebeb6c79939a0e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f6a6c60642c7cb0b44c27821fba1735cd041a030a1d53f4ea8ccb0bc0b8c3af1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 17dd3d0af34e191207ce0ae3ceea5d93e8bfb1e638aff1619196c6d421537179
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ea00ddf402acb0fe67a37ce122f55e1d446fd97af0a482606995918699249753
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3a26d2542ab7d62ea3d168b8083eda0ea1f6d581153c405ef239d5df865e558b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9ce02c8ddeaf830aa32594d24400fa9dc20c0d71ce9907a73b24a2e44388dd7e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b149f3188c13f9522174f3df6909b0259593b73757bc03e8e551041db2da4a42
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e77eb1823e2fa03d4aaa3263c71ed9cdaf4f7870c0ef2d8a9bbd528ff534985d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 866f9d484ca7d2245495e6398782a20a5cae2428bf271cbd035948145cd269a2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0a35493f3432da66425eeed2b8a75214659b8452b5cca98671932ac201ef3946
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3847ccc45659b12cadb59d4893344764c99735fa7453479aff97c2cea39eca15
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 22ab143ccd9e095a4a7a0849f6d63fff284e1b94d018afc5f0743e4d9fc78f7e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bd52f77a5df731c13fe038f0cdd8e9de4ef4882268312b807d3c73f30dbdec8a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6fb9af5bb1615b410803b13980965128ba63ba0af6c9a349f6e355a92d7c381a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 830a835cb5b24051a815463067a30933b393f50d0a15b13cbcdf78ef436a5d3d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2800cc89ab2142e2b10778ec30be530f2aeff5af1577832a40491e63721ff99e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 282502108dc3f8b24485346c24f2303c7525a1462088171032eabc97e6c75bb5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8eb205be47fb46c7fe7928351cd3024416594aebd13755c9bcbf4ca64b23efd2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9083b45720f7a8127bbd1e2108431de248e58d526a51f4ddfff17c8974aed955
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 172c071954183b9440145e0c5029edb93fe2bfaaee843df4fbbccfa4cbef02d0
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c764f1e424ec7e8e4dd2d4ee0c518f8135af5942babdf21443494e25d2b55a9e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9bb79f16a1352e6f9299fccb239313ed72134f6f96c1e3410b2484cfc07777ea
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b13126a7a096a8111f20c8c2931cf0029164a83294f8e71edb12b0a55558a48b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c55d0b9b809f0a6ddd6347652f263f0175bdc5129a1381188deb9373f915c06f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 15baca44810dabec2c02988bceea2315b44edc4508f0e32bc787ed6cfa0816bc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 70a43a8e9ba9db647b1fc647a9ac959164e8d810aa9a6955d60bcd3c1121422e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 268d4ccfbae77c60067c87eef3c3b6ff4ab2bd65d43ef475ed7580b50496d5e2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bb3a9e330b9107c3ef1d58cbb048b07ac61869777bab6591666a77d116a4391d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bd901a7ac5ebad3aafadac2760934936251784174960e388c11372c49957ea90
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 36d8ba8b46d682a16bbdb4c03dba2639a7814d1cfda287c3b205ce34d9dfbcdc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 38cac504dd88d2e52aac83ad6e9e1e980084b996d9eb6486630fad60e18b986c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5dd6d2e2226e6c790d57e458fab896cd90336c5141bddf67606a95dc77720501
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4ea3cebf4cb9e7107743c080987511f368e28a2e993e393d75dbabbdfa18b157
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a60450cbf6964453c82d91ddf11b3f3a6cac722af784298ec1f810bb60dd3f28
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e1467e5fb025f5e001db4817792cfce2e783b758965d913784534191ce09be2b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b885e416414fbc935a51f89db23b6eb52e4063ee69c328811c80251ba6ab2a61
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 66bc453e24bccc17a8a8a47f23b8039af2b0a171a5d21129d47956b625e398f9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 cb168e48a8ae4de2e4a6c514434f6c5530d13afe5de9ec201eebcb5d7ae38172
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f72b7f0b89661bcab2fba0a856e283dccd7b399055751d45aa6e7d43533e6c65
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6c3ddea9fe8b863df812141a760df9a244a6cb2e42ad0f1e40925d6fb914ea13
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 af40c8b217aac335a36b44e1976b732bc5a9c579b7218a12c025635481b81de2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 889aa5f43a15e1ffecfb7e43863a30db990ecf4a233276346f3c68bc40e21869
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9d52dd55046c754fcea1df0aa01c90f2872b37f70187aec6e9aee9d244b2a815
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 481c538446fba1546773a44a4930015ddbfb35c50db1e6927061b5d86fc39b5c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c39e1ab8c1d8f5e1e879b35e7105052549b2b32b4f7ff6e94e7b3a59f0512263
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3858429dfb24ad359adbb8593b377d4aab2b7420392ca0d3ad5b42368cc6de71
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4b59963d2ac1ad2bf4c253f65b929ee019f9388f8b82c4095096851d1b2f1e7e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c71ddfce0a0090a3598191d41cfa22a0710f26b01a6e8fe443542c5b76874208
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4a9e22c5d4e3ae88e22cf8a401801df2b1c92d960fd13ca8172f57c43a417b2a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bd82a87b81bf6e5d2160a2a200fec8f826f1555729abf0271ba8c7a9eeb0f1d3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4e8314f988bb4da869c5fd5816a879729b6ddc05738d59956f68733d582034bc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bbdfb79c2310047b4de56e266f6b0d18f8ea7795fb2b4d78a73875c4534f57bb
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 599809f7ab1246c155087b772f846ad30e2fdcb8fd4a1ef406c2c71bb904e3f8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 92b7527d8f53822f3f86c4ca0db686b730225ad4b7ef3205e492e679114686dd
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1c658f227b19495fe5c2d6faf82a0765ac704ff8a5c901d3641d48fb6ae37f81
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c2a569d9a6505eb6c13bc85e1a208a24db0e9b70a1821af9e9e90307e253afff
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6f76683cc08f8ef02fdecea7a7a38e0b09761da5745a4ab566bf886ddac06b04
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 57f7b19867a323463bc8e39afc2efcaeda39ed0b398fa3f34787317231162ff5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9543b61b3a5211f66f0061b9d5950a030db270e90d286b7341489e263d68bef9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1c8511258fb8e90b9764a48128248f8273ef096c2d2a0055c0c92a3db13639e1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 723c548d13206f6c6dc563b43c8560925d4a542335489d767f2d15b95ecd3819
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b98dbf342f515e32b5a5feb14a58ae14cdcec4d75346059f5b3f91906f2cf1c7
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 06c42f1d72fc0b0604514bdf4edea9199f79eb53ec0a543f7087219b2e346953
            • MD5 SHA1 SHA512

            Admin8

            • Path C:\Users\Admin\AppData\Local\Temp\Admin8
            • Size 8B
            • SHA256 9e59953e0446e13b7209bea931f05c52b9a7c101c5e5c5bbaa08efede856e6c1
            • MD5 SHA1 SHA512

            vbc.exe

            • Path C:\Users\Admin\AppData\Local\Temp\vbc.exe
            • Size 1.1MB
            • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
            • MD5 SHA1 SHA512 SSDEEP

            Adminlog.dat

            • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/2604-180-0x0000000010480000-0x00000000104E5000-memory.dmp

            memory/2604-82-0x0000000010480000-0x00000000104E5000-memory.dmp

            memory/2604-20-0x0000000001480000-0x0000000001481000-memory.dmp

            memory/2604-21-0x0000000001540000-0x0000000001541000-memory.dmp

            memory/3112-1-0x0000000074AA0000-0x0000000075051000-memory.dmp

            memory/3112-0-0x0000000074AA2000-0x0000000074AA3000-memory.dmp

            memory/3112-11-0x0000000074AA0000-0x0000000075051000-memory.dmp

            memory/3112-2-0x0000000074AA0000-0x0000000075051000-memory.dmp

            memory/3504-155-0x0000000010560000-0x00000000105C5000-memory.dmp

            memory/3504-184-0x0000000010560000-0x00000000105C5000-memory.dmp

            memory/4004-5-0x0000000000400000-0x000000000046F000-memory.dmp

            memory/4004-8-0x0000000000400000-0x000000000046F000-memory.dmp

            memory/4004-10-0x0000000000400000-0x000000000046F000-memory.dmp

            memory/4004-153-0x0000000000400000-0x000000000046F000-memory.dmp

            memory/4004-36-0x0000000000400000-0x000000000046F000-memory.dmp

            memory/4004-19-0x0000000010480000-0x00000000104E5000-memory.dmp

            memory/4004-15-0x0000000010410000-0x0000000010475000-memory.dmp

            memory/4004-12-0x0000000000400000-0x000000000046F000-memory.dmp