Overview

overview

10

Static

static

5

0824f27a55...18.exe

windows7-x64

10

0824f27a55...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
  • Size 673KB
  • Sample241002-baa29asgjd
  • SHA256 d38734f0ec2a5aac9c23148d4b3787222c8cc4ff12f58adc36aad1d42cc3b06a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cybergatetestdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

  • cybergate

Version

  • v3.4.2.2

Botnet

  • TEST

C2

  • 127.0.0.1:3213

Mutex

  • 4T647H0HY883J4

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    gwregsrffewgttzfxadhds

  • install_file

    oxytytmfsddndfafe.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    PID:3536
    • C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4068
        • C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
          4⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4172
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:632
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:2864
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  8⤵
                  • Suspicious behavior: MapViewOfSection
                  PID:3700
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
              6⤵
              • Executes dropped EXE
              PID:1440
      • C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2088
        • C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\0824f27a55f787003e194bbb4a24f551_JaffaCakes118.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1604
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:5088
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:4404
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1944
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:1592
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4312
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2840

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            AppCache133723042235100644.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133723042235100644.txt
            • Size 74KB
            • SHA256 8582171d09df36fe11f54ad9421a6276bf1fea660857a82489c2b3be1e3fdec4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Admin2.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
            • Size 234KB
            • SHA256 7353e597cc3123e959ed0967b80735ac55ecfe4f589b4392cc5ed4fd53208f2d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9cd2192b490a93ab7dddd1a143736a214a68a5704d6c6952474acf0d71338063
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 64d0af1a6befd34f2b918d41e96817990176a4f06c1445e397167f7e48ecdc0b
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a73d03b2bdc5e0dc75d545acb738e2b40a40c545b5f81e79a68fbb77249068ff
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e1ae5050a9ae0737c2e42440ead9a9604185d45336a4c10adc3a145252274dc0
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 15b6bf77bc8ccaec80b0b3ae11742b70bb1e32abe776185a7eaa02dd33b4c6e1
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c6648807e5636eb4d77d36a72d28babbfca546eb2f07594970dc897f1bcd9fbe
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b16ad2dff730e4a463d02e925e8e374a28ea09af69b654148b0f61e5d379b6c2
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0f95dcdea233f624d59d799860b0c1c892447f14c447ae7ac457942b5a9ee0fd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e208e4082a314fac69296b22c3535a4d49399c5c19dde97ad366485e3ef16b35
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6e3849a95dea17bf78ca4692b5ab104e78b68cbfe0ee7f1548a626b40cafc98b
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 87e62bd93362380088003a9d3e768dff6de68d37c09aad0686f68db2020bed54
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bfa896c58b58834fcaa93bc6451048ae1e059f65dc4078d0dd9cc3e8aed7ce6c
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a55cb350c0497ee431573fc3c02562d7617c6c72dc853dfe8caa4d2bebc513a1
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e229fec351740b1c92a7e6a7f20e30da34cadc078ea930c1170808170752646d
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 203fe70e5bc2e3f9164cda91a52ceb2ab3ebf93350bbdc5fe9fd89a9ea82f8de
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0c29417ea46f77f9d3c8e4b15707f0109400370b02eb0a1eca0e98379305e27a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3d781b74a85d999c793e1f7b69c10e67ed4524e8f645c01e09ced98882d3a2fd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 17ad1016ba13c04008243403e0c3ba74d150939fc67d5533d991cf663459c79d
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 089d3ec318bc3a6b6e539c812eb5b2d8985cdf715634c1e65064d52b4849d3a1
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e482e630f6d9c626681e4abb226e42233b48c29e436ea5f03c623a47a321c540
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4c508a38ea0388163cc679e6b50a2b20caf47934021a34fede74080baed8a652
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6ade9b6c3cb40d22daeb9c3e8fd22b2f6a933a57daf15cc82ef87d2fb648f4db
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 393e0684d813601ed15e99da4f7c338aca9b5221d34727a4c7fbd3ca729e948b
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 103bad67a43ca5982bdb7025b6f84f596166a76d56a9d00cc0d9ea4419457d88
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a23ad351a33c84c4304cf95cab8ef9c02674eee40414759d706c739cbf072f4a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ac99dc08878a3a36f865a1fea8367e106bdca75d50b0aa20a9667e8d354f84b7
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 cc2cb2168e129d70ed862da3393468dfcef875ebbb1ec4c0c81abf28c15a2231
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ff8e03e2b889c4e24d54fac6ea327085fbd465d4cbd2b6989a7920319ffe5175
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8e93b686315d895a9a584cf59398c3c0a7fa939479fb36b841335ba5cb645fca
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a4b887db00a0a0e56a5ed69e3cf4423b00039f6e03fa68d95bc36718048870cd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 617f6f74c43d19719d1cc4c80608468a59c2914e264275513a460026a0df0cfe
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c49783e740389377d941b71f73ec737c6d95332eb0c747929fb1b784f5e8920a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a38092f0f7f86d89b80dbfb0de36f7286589553b85fb59e58f5e546fcfa91f13
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d3368fd77032a45fab02098b195e09a8d35829861948fd527c6b2a78e3c49abd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 54600e1fa1d7ba4a2f7de322aef6e2dfdde616d2d0fd792a52acfbdcfb80cdfb
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9af0a62f2ed11da8e519374cd8910a751f0f9b53a975699dcb57228a351e9ecd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 19f1a3b98c7ff74b357fb09a5072e69846e0822fed0626c47d1f4ede1846bb5c
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 be24a62e56148f9442f24cfb4158b17a999a6329f435fa37b041c2862951d5a7
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c9a5a979eb421cd2cd497fd0d38a8ab93f5e493b194ab6c9917150b4b45684fb
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3ebf0d1e3d1ab51a2cc0e4ea026eaaab0935982248b6f79f8fe67f6c77d11a87
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a5409af605c6c974fdfe087bafff396f2628c937cea73f646addb51ed5e714b5
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 41dc317b266e293b2e9724be1e882f4b9ae48017340b8256860604132e9ff08f
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1b87fe6010055ee959c1e6f806f83268a8294eea421ecb0ecb3465de5886e94f
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b225a1ae229f2eeeacd7eca4a4e6fdd1a961cbe14b69397704a7f9d104d0b06a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d0fffe29bf68dcfb4635f42fb51d9b83209ee83df8c7f2ae57488e4d33811842
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 699769411ac898a79d18314a5cfc9c91406da5a6d92a3980722621f99b9b46cd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6e6af89d6d9932787c737ec27b0fdff555a5eec6ade528864ff98145b434ec05
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d9ebb76b301647e986067969bf24e2c1075f8bcd070ba53d1fa686d58f071d3f
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 20181ee14a2963746ee110c724721ccca665189c5acd1f4b1238796feb776b77
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e260fae0b9e59d62724a5ae9dd1aa8f1d44ffffd39e138bb502b1e1bceab1c3b
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 85a55e360b078bbd9bab5534f67940925be45173ff1848a6f9889008e1086427
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6a0f4293d21ad8f9a96c968e84c37a9c64b54df7d2e264ba6d536da0031bbacf
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c0ff4a228c2b3036efdd577018709120c1ac7ef11fcfd0811ce800ea55af7d04
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2ddbe147f98142593eed65cdf10b7fb40f3847937dd9bb774a678d568e587840
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 266ea627088abe9027cd256406e3f34b1a8a6b6dae6305a7590144ac16784330
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e1d112689950ccdeb08de460075e1f84ab74b7b748b64aaee1898ae6fa6126d8
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 aa177746839117e1c89a9ab6e6dabb12f58bb0e025a28716a89757662ad4bbf9
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 dbff35f3d8eec27119efce94237fcb7de36151249657982e1c89688af8d4b7f3
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6e64016cab01fefb9e65652795e0c920d8ed61b516475f5054dc48250d829ae6
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 26dbff13f3bde7844386c765ba430bd5e84bdacc484f68c288180dc3b4696766
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a35d3cc8374e1f63665762412421441829c78321d5a4456f9e06188f5389f7e6
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1bc9a9b85eebcd40d259247b210722e0ce0bc195fcffb7c0285dac3636595b3d
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9b59a90efd7670814331f98a6df2984b2a9c7114950a71547e3c8cc2354fae24
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ba43544d0380f2a49525b2c69bb18e93533c1ddf20f8c59166194d790c3def26
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 82c45d503d06db8f34e6023c27a15d912e16c2724b0153ff274dbe4bf24e983e
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fa13ce7c3518bffe949d18e1c758ef8d2dee0943cc5a30168113ebaf5ab8c88c
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6373c0eaaac86539363e48683de9e52d7efe348c159b9203745839f8aca24ae0
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5dd25792d1e55321cc30d05ca43b71c5d25f3621a375115243b09a6a620e9374
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 64ebe57d85c36430dcb50014fffb5e079a48a2ddfa7805b74f528f9bf0fd233b
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b2ce4429d243ae081a227ee3feae24fa83ccf47ff27b86f239dc3d3db566c6d7
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b395891018627cd7a47781cb08667d51e7fa9d5315a401401799ccae3326afb3
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0085b459b4247789126f097efd650eee10d25417bccaa6eaea35478e08ca9678
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d9266779eadd99b7a603219dc2bb16b7958b5d4b217a2640e7bea64b8b373ff3
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 adc2fac6098d9e483c55dc344b19303e79c8e5df673d83cfb1c5170759979e82
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8f4a9276141822a7a5e9c06cfa8cb9c0e4ce5d2dd6ce95858235de500ef968b6
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1efe2df593ee5a9b6bca3d4d31fadbb6e8fa1cad9b9aea36f5e6f9d89dd26724
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c544c32a2ff591dec87f1d995ab2617ac3a7e465da724c4a801eeb755ffe59d2
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 08a9de706e7776083dded8b59032af92e0ca5ad9d5fb60609c2156e0442ef3d6
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e72742f00924a70391940d637597bc619a07a3dae70bc70ce34478bf6a659ec0
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a5aea0445cec71b651d742e28093ad68bfb8cf158b3b9d550cd080b3288c3333
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 119b1a9334ea607bf105fb9cd22d07b414d46d1e9b9bc19522940d3472daa3a0
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c3cbf10ce1b900ade944e2b996b24372b9f4525f7ff584f251e9a471bd693ebd
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9d3330116808795137082b401a314f7b62fe223524b8d77f7ab8bc0f2221051a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f21b5681d2db1a37437d73525dfc4bbedf72aa078ac31fa94e00af9fb139b1aa
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ece02798b15c794b71a52415a42f97174c57ffaaa93b3c88e1d165761d47f1bc
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3d2c612b348940e584029f93be4a1503dff407630c2e8e53dea077d8aa03b2c9
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 50d3bb9a37d8651664ad8e6e62895b8b6b208fd475cd9e900a255bdc72f9f83c
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6ead4c0afeca885e9a6607a862205c9e2b45e83209198e802507dc44f5efaa45
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 61f5b22fd121153bae50bd04a5f6d1e7390afdc4e90637ee263ed720101cc6de
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d79b34f2e6712195397a96977012695c4d132bd548f845710f721bec8d864e24
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f25b354cd0a0db5a399e59226f270ecc494484c4bcdba5e0a91b1dedc1870fe7
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4b431be2200f312fccd9c588f3471365b9921c7379c14d1bcf6c7526a8126ab2
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 482cba1c187c5b957aeaa647d6e9f8b04021c41a34369ca98f57dc2edc98b75e
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a36009004ec4c980bfd032efad4a3b9651963a9011f30269396cd8f7dfe6bb3f
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e4a5358d03e71cd0a0622fc1dd5def02f7594c713ec3a0fe0e8666f648fccf09
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6b01e78ab794fdaea8e7c63078cacff16c12007203cdc6f8ba5d3a579e8c6423
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 217db543467ed7c5bc31512870ffa23cac650b63592d2cf510a6cd4448c91eb8
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ea6a1466270843ae56410df3ee6f1d2f74048eb6441d141afe4fd048248b5fe9
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 86120d037ad18c40fdb02508cd68620acf93f2922daf49c4c02a656a5bee0126
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 063538c6fa00161c36d2a37acb4ba98f0b5cf35463111b9540fd5f7ff6d9b7f9
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f6186c269cbb70ffe3f8734cd5b5fe0d6fb7e6452a926541c181057dcff9a9f2
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 7d378d5e4bbe48c42d20d69af7f22b6ec69b6bd34365ee34a6d961d62299ce0a
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d504f6a711403b51452d0315f5173fb7b5159e2f26323cdf4eeb9ca88a5cfcb8
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 04134eb1c2826f29c872fd906967ae2a4f6c63a13a812d477754ce79b62e1ce6
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a071cb266c4f8a81462d4707e3d70221cb1e53502c257439508ee75d3cb8654d
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 cb3cf332592bbe9d7406513e8ce9cab9796625848a31a1e60a846011320b2474
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ed1609575b65d0aad82fd05866af9204e5fcaf721072c624de4aa8ee9f830ec9
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 36c2fd0afdd40f13c70704dac38b460c523715b096d83785d8fa0db837dbf850
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0753743282ec00684f356cdb20a34a6ceda4e8e5223b70332ac6c1f8f822e3e3
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5d785d0607d17e21f3e26aa8d0d1e8ee8f7e6857829daf80760659eea4c774eb
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 379b86f06d2ccd578dcb5e0e89eca25c84cd33ac9a10d82af0ac24752dec3fcb
            • MD5 SHA1 SHA512
            Submit Download

            Admin7
            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bc926ea43e5ac62a39ad4da582e71c0ff9749342a2473057bdb173dbabf8642a
            • MD5 SHA1 SHA512
            Submit Download

            Admin8
            • Path C:\Users\Admin\AppData\Local\Temp\Admin8
            • Size 8B
            • SHA256 205eeea874cd2727bf1f8715e9def39b2cb9b5cb759dfe8c339ae15c82fd574e
            • MD5 SHA1 SHA512
            Submit Download

            aut1921.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\aut1921.tmp
            • Size 97KB
            • SHA256 5a1cdea359b8ab1083d8a67ec65acd8613408984e43f1dd5d74c61c121745717
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ns.txt
            • Path C:\Users\Admin\AppData\Local\Temp\ns.txt
            • Size 277KB
            • SHA256 7c2a4761847ad946bfc84cfd64be16aa63e66940997a79cc91ba3677b7add559
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lsass.exe
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
            • Size 673KB
            • SHA256 d38734f0ec2a5aac9c23148d4b3787222c8cc4ff12f58adc36aad1d42cc3b06a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1604-1384-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/1692-22-0x00000000000D0000-0x00000000000E8000-memory.dmp
            Download

            memory/1692-25-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/1692-23-0x00000000004B3000-0x00000000004B4000-memory.dmp
            Download

            memory/2088-44-0x0000000000740000-0x0000000000741000-memory.dmp
            Download

            memory/2088-45-0x0000000000A00000-0x0000000000A01000-memory.dmp
            Download

            memory/3304-40-0x0000000010410000-0x0000000010480000-memory.dmp
            Download

            memory/3304-31-0x0000000000400000-0x000000000044B000-memory.dmp
            Download

            memory/3304-43-0x0000000010480000-0x00000000104F0000-memory.dmp
            Download

            memory/3304-352-0x0000000000400000-0x000000000044B000-memory.dmp
            Download

            memory/3304-34-0x0000000000400000-0x000000000044B000-memory.dmp
            Download

            memory/3304-32-0x0000000000400000-0x000000000044B000-memory.dmp
            Download

            memory/3304-33-0x0000000000400000-0x000000000044B000-memory.dmp
            Download

            memory/4068-11-0x0000000000FE0000-0x0000000000FFA000-memory.dmp
            Download

            memory/4068-13-0x0000000000FE0000-0x0000000000FFA000-memory.dmp
            Download

            memory/4068-20-0x0000000000FE0000-0x0000000000FFA000-memory.dmp
            Download

            memory/4068-29-0x0000000000FE0000-0x0000000000FFA000-memory.dmp
            Download

            memory/4172-2637-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/4172-1121-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/5096-36-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/5096-0-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download

            memory/5096-1-0x0000000000400000-0x00000000004B8000-memory.dmp
            Download