Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2024, 07:24

General

  • Target
    1c352ba2f4bd8bbe87f19c6b0d666671_JaffaCakes118.exe
  • Size 2.2MB
  • Sample241007-h8l1qsxblb
  • SHA256 25f3d61ff9543638c62a86db75211ed17ea7c3bc7923808ecdc88428441dd700
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • test

C2
  • suckmydick1.no-ip.org:1337

Mutex
  • 2W1S0O30U176G2

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1337

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c352ba2f4bd8bbe87f19c6b0d666671_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c352ba2f4bd8bbe87f19c6b0d666671_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1gt7xp-l.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E97.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7E96.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4276
    • C:\Users\Admin\AppData\Roaming\lshss.exe
      C:\Users\Admin\AppData\Roaming\lshss.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4196
        • C:\Users\Admin\AppData\Roaming\lshss.exe
          "C:\Users\Admin\AppData\Roaming\lshss.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
          • C:\Program Files (x86)\install\explorer.exe
            "C:\Program Files (x86)\install\explorer.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4996
      • C:\Users\Admin\AppData\Roaming\42267.exe
        "C:\Users\Admin\AppData\Roaming\42267.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4284

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          1gt7xp-l.dll

          • Path C:\Users\Admin\AppData\Local\Temp\1gt7xp-l.dll
          • Size 5KB
          • SHA256 6e21804806e7d6e916b19b94ac8036856fe75aadbafbc7c9d9c64793d1f33e06
          • MD5 SHA1 SHA512 SSDEEP

          Admin2.txt

          • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
          • Size 224KB
          • SHA256 90a20b15087e32d680e7d5e39302e9b849fb0fd049cca15994981f10940357b0
          • MD5 SHA1 SHA512 SSDEEP

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 194122e8a6fcab4dd8addad634023e0ccbb2670130163ae3e79a877304c59b05
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a772f6c653faa1b3e87bbc0d114b2f44d30f2b016364829fdd4af56757bc60e6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 35bef85cf12c7b871dde8698708dab9bf9bc987882476f40867ac6b8e3bedfd8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5c63732fd28d618bde0175f158bff5fc24c1f2a496bed54ff1ac74d94b6d5690
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 edd81244f22a0785b21c18794fcbc3bf4db4fe421c5d1944fa0bf00a0ed423ee
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b291da38f0b91415f91b2d780c9763382a1b33bbccea5caa44ea95661a0fd0c1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b04baeb379f0c648d46f36cb6f49d4761c2f63d653fa1e4572ec8abf6915de27
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4d1ad2fe556d38ed1583b31b79b638f9a145f22fae2d01948175974d3490fd83
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d643450965bd0027edeeea407f1802f635a03e015ba33bccb830b5b7a1f82816
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d0c882a46b9bde7f6a54db0cceab3868d9f016ea26f2177334715a3c96696a49
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fc1890f4f936eb28c760c5a4c18abd76eb75d83f631a891ac39d5dfd8fe32f1d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bf4da11fbd41b380a0cd76fb1d359e9e36b2c175dacd8e2cee7dc6ef098d330e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 211a3b5e9895a07719631048e53bf22285c7906d6bcbf07777aa3548bc95a1bb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b18c2b35e8472d19c22d6a725055880851b426ebbb4ffb8eaef6089004254019
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d3bc6b7aaa14a1204dc37327b233f59c471ce026a1bfa9518a969c05b98f19b8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 97cbdcdaa8885457e9ebe00b9f712831a0d427a7fb6c43c875f3813068eb6b67
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c2d4fc7d400f7e2a8cfb01d4d54dc6b584a44cb0242de83de1f86fb5fafd6d0b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 78af1c317949b37772370baceb2e5a82f7953226f82f023cfdc3ab5c9c7af5ee
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6e8f833b7829db433d2fe7dc6eb31606184160558a12a255482d71ab996f007e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 58a91e2715230e37c2a33393d641c3529885a7e23a331d2ae8920e339b011c8a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fd91bcfa779f31eaa183ba21b674f0e0c49e3fc316179c7a6644db4520ffce3c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c395a11f83b738cd51c740143d80966bc2c535f3735c30e8ed26a4398238fb72
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 608a0b8344af9cd93452c4abbc7f9294f5cf7eb49e2fa01a78ed0f6904a0dc0a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7049eba4eb5f80d7c63f414b2278444075e1577d519782e131048e1f5b722270
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d2b75ff13f851fdefca4f05d7c128d3cea46f8e30bc030896c3312598897d552
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 30da7817e9434cb9e476d5f1ccf001e55e7e529b093053be8a4359604e55d33f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a3887f47e1d7f96aa6f5b868ae8c27ab559ccbc2d5219a15fa49798f67477a45
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 12595026bf35a9b60fd9a7489c40ac76e7f66d300fceade4d6d541e1ccca8949
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f185376c78d11dc839c769e0ab829af697e3d2cdff3f1aff0a0389356cd1c924
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5e2d707fe8221de880d0bed13b743f4353d7a74b32fd02ecc35134ae90a51524
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f6c91d7930536c59fd1b63fa67ab927276ab7e764a86b57dd6038e6491b0cafb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 48b4d27649282abc25a8030bfc291d1def6d31725a9da5dbd91b5aa12c079b2e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 44d98461bf8ec2747c447174295c0f4bae8a26208bc989c231a8775615f86734
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 53ae1bc8d143ff25b5a7b3afcc48c34c8d39ce6da0bfaaa92c60e2b7388199a4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 07f9d0e07df880d5a2f8b8d5e2cae2226bed20eb4748c858d729438636e63f41
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 328104d93b7d807fcef1a6c88901449d1d8c86f4a91f2359aee6ecb9df3202f0
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 78ded049f8c09fcad6ef030142572f9635016a2831718e52edd53c656582c9de
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 eb2907fbf189227b72887ca30ba3f8d08fa5ed2cfdd93db86cc0a4bd7bcb018f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 538842a2bd93fec1fb20db94da19a498ce61305d0c7e89f1e88fc0ff708ae510
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2397f31330d6be4c8b61092a5a4bab5b194c3f6a3629701e1505becea1bd7e18
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9eabd1a7938d45afbb0912eb3795f10dda4687b8d4996c6eab1922545d6d3161
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c8f77e2feee87ac82c98cb4c095d1fd8f84238b4f738aebdd0e6900d04021548
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6a1bf9e47527046868c165aaef79985fc9bc821ebf630e19be4a90b0e4e34a89
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 567e1bfcbb651466d8a449b85997585f6604443916cff255662104a08284520b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 10f2c4b89f2c793281dc12f9be68058c69a1dca2ccb7d78b2d7737e8a69d2193
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fc902b82a0d70f0a26be1ad43d20412ed4bf8ce5edf2376b0ec413c585f6c5eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 253b6501c97b68e965397caa002471f70d35b9877c8a20834e64202c6368d2eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2dbad7849e3860d9b1924786be3f0313b7a9876d7a28d903501817a087a836eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9aada95b27edc6ad5e00f26cc39244ad3c4e3ccd86c992b440a6fa17a02f38c4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 07b6f22b017ba72f953d1ccea8401ae3cd758d6bbb91352f9b97575fa7e3e398
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 41af7c4050ced620c2ca6cd9dfff612d815dd313fa277bb818be3bb6ae1692b4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d354f18698efdee2adb6d4760c608e4fd745b61743bf8c3d86fc78155ecb677f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 79ac7db6e9269880895bcf71620c51358cc4c061e656ed6224e4137bcc69ab27
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4e173ab00eda6762a949adab5d6b4caa699c6777357fc870e7f2671cedd1ea05
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 89ef21a62cec5229378c755ff30f5bf2c058b418455b76b3d11c035f512c1136
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7f68f35fff0febfa3efcf84e0768f2d5f3ed8c0e1aaf9ffea885d85aa1af697e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ab7ebda29b3f721d68915303298743b73b81b19ad1bcc0d65bd901d61b2d30fa
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6969bf203cff7fce4d1e694cfebfc5cc07851ac089b30da5300537c33a8a0012
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d5f1eb82e9383ac09944c3b9d82ff86f1d9a4ffd56232d436098652f5ac20b67
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8c6cc78ce1c9b301ff181c448f9a5220f9d9a307ac8f1cd3a1ae9508b2b43af4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8e2555429e3af7e770816e916f108cd839021289c7d0a4e3e93e2f12a41cd9de
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8335d066c3860992b50d3e3ea2c91c2455eeee243b8a429db7451b544064f078
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ece2442eed6a33cb694d928f3c5f2263cc6b867a050621885ccd203488e3f6e1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e88176d9348dd3fa0ae63e62c12bfb98e781b26ad85eb6db4348c7007cb105d9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 838ba387d7ab6cce5ea2a1c22d4aa8c21934cb8a75538d47d4f1d003dbb643ef
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 486771dee0929602f68c64792c7c056388ea60056a34288eca6ee2d8940921f8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cf6397b9a55f2458e8039e6f147419fb61982ae2a9632ebd76fd7edfced3da3d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7586848b28b86ce84133a76fd5de7135c27b16458ca088115b1cbb9f807b3e2d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6ee223c14a248676ee7a469668f54e980027c22c27287fdb773770e967f97014
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f9685d93e8b6fd88cc402288a2bbd135a4895e4ccccf4ef46e821f96348a5cc3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d41275b7156667c6c31d362ff95e72a698dc34a95a747e91ca17672fa1ffa7af
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f49fd2b76570d4c69b84c5cedfefb06236cf499608d1dc8d4cf9592c6fe7dded
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e40bd9ecd5fe74ee3dfeadecb6d67f884fbd697b42e9fb5036255ad9cedfcf22
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0dbe5c790c3552e4dc85e19ff1c328d7cd8d777176ae52a0502712fff50e7947
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 493505efb4221c956928649bae5e51ab0d92c3bf95717516d941141c37de0c0e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ea50a950f92b3e8a1f21aa9604398dd964c248bd9969962719472464054714bd
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 82a6200424d506d056912bf7729282aa476c8869f53e55602b40836c3a820b4f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2a7d92235e8c5378629c32ac511ef4222ac431c410eaf24d6d67b4b89923823c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d9c6f4251ed56ef6c9f1c2e3ee2af75ad30a7d0f5ca6860c30cd0f417b03540f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 51bac0a63bb2d5c7b2cff49859fd232f81eace84d9a56cb11ef8e3589333342d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c2a25b8b791f4003d1c1273ac2dae7e74327355a7443cd8f2483b909faebc012
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f09231c84b1dec94d37cf899f97e61c965f940c8a543f51fadb6ceb0437beebc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 80dc8a77555a676b534a8410374c0d475050799c7e86c6f727136f22ef566c96
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ddd093b32670ac5d169c00817b5853d6ed71c1aa446a217d5f17d4c14ec92a99
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bba518ac1e1a26dceddf005c408cf72d944c82148fe26a72f8c5f50eab71d107
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9470b0c9a44a3158d7fc7ddb51318ff9384b94490eb9ca945dd55d2ac28ba6d9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 26d7583d6651a90049e13d97f44985502afb361e00d08ab7206f53724834feb8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d01cb4c71d3b201aac9057ccb5bcf3a21389469ad15f767a7a3ee47512f27cfe
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 813156acb772e18e4b50dafa2ca406d83122382e87e4b509c5824c9ef6bde476
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 af1523150926820ac03cadf95991dc7515db77e201154a91ed33c7ee0184f608
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2ceca328387f84b81ef7359926986fffad96162c62ffd1a63948b06ac9d91c9b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7ffbd6df3cc061c596b0d8b1e0797a545e0752bd1d9176e320601706984dec43
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bb9cdab74beaabe929278e4accd090c385ebb99d344a67f8f7993fdce0dc3116
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 47cb41f5c007b9914855bd0e5cfa196c210fbf4364832cc46cd0a093282bf6a2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 87d9f02bcdb8023587e9d0b9985b43828f6521d79f94cf22cb97314e02b1d636
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ecea58306bc6fdb79649d707507d93e4f060cfad0a7c245ab5f57c4df45997b8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 45b8b01c5e134e0aaefec4cc85b4ae42352deb1d13bc55bcc7f58014167394e9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 da30a94444ed6ca7573ba467491a4833a5f54a49f513921cf35511e5547bc4d1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 02b946280ebdb6521f71992aec8c1ce494ab4efa7bb84a4f80b83417132b025d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ce509a28a1cc4f452fcaacfc9568bdb8afe9ded40e5729d28eb9aca938775560
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6fa33f3913978b5f241cce82353c74bfc38ebfd7624efb28d6ff1e07deed093c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2bd3eb7e4a873d9c7ea5a000292096e83a071ec6bd7f4ffd818476dec29a5d2a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6b1110dbce6b8d7ae0bf8273a2de29f8b4f204552a7e9682a9745cb9cc3314d4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2918a00bfa9a9eaf59658e5ec85452fdc7d4dbcbc6abad8ed0ede8220f20a6e6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a445a7bf81c4350f6c1c86dcfa5a19c64f211e6986b4756a0daabb69faa590d5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5f3269947778dae19c8505266ede1b30c10cf4a947f413b9fb2328f38ef10568
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 11c9906a282d2c660df4a5be6801d5216e796a4e51dd9c172a4076a6c890b9e8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fbdf3e041faf4cccd315640cf80183c7003678e02dce9be605632378fbee2b41
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9f2ef913229b0fd95243c0eb751ed5de62472b76fb8668073d0da57e486a5c76
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 14d39d11b2f850b8b66fbaf1da09a593f88d0293ffe9f7a9ce7803e85a45c073
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c75033f13742c6afac4cd3bc0a7f17890bd81062e8c01cc7b81b3fd38febb765
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1105c6b99a7d9dd9df737b54f4a90ba01edd4bfe0b650d0215defd602b036564
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9c908fb4f3cedf7492e9c45a58dcfb5fb39ad4c063a402f8f878167715c6eda2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b64e059e7135a1a9805a925dee5c7a115ac242b03a0ab6bc7a4494d73980c02b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b2b31513ca70bc22af661c1b25bd37fa8c7bf3aed1907c53e1f971c1cd887eb8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2c362fa295497f95a3f4dcf311d27877cf3aee4fc681ffaef39ec1eaa12d4996
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bd4aacace516937c45406a2bb14403b8b0f7ebe143a0cd324b4dd7a302373f6e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 232b372c6a250e27c7d8e52ac46ada7eaac23e7790e80850d89c987746ddfaf9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8b7af0651ad7059d985b5fffe1ecb56a6e6de8d90c0cad91bdda60886d2ddb80
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bfdc13e76dd7c44d309164270beda5ad80929a1c3d4102924bce0346988c8257
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 30015a63034c8594c75cb1ac665d6c9f93995d0bdf98135395b363e44c192b2a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 46de7b2c828b8decf4e7ce017c8a9dbef9d87b1230bd22b3690ca3b65fb99a71
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 25dbb06c5dd3c070105f5d6ac2060ef79a39c425c7e65018d20f9d551a375b21
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 41e8c9d284abf844a4ee1dda7a2f7b77b32564d9242c60527be6f26067be7343
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2d0aa03c10b969a66330f04b395ad363df3ba5da32770cc55c529033ec75249c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6cf33d37e7782adc96efdfed5722cadf640c67eee427ef9a5564b3b421adf579
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6563bcbf5566c70514ab049533b4ec75d4d696f3ad78b72f19efdc545c941ea3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2729886893079ab444801991509e084467798f74ea90f0316ecd3f55c44f116e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6a472ab1ba62f2bd853f608161b84e80795012885c2fc40ea05c46817612316f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6ba0930eba1f0ffb2ee12814df32f7c3cf1b8154f4e8bb47e461bbacbd52692a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2a1e0c86eb8df716f248cb9093a80f5d543e7b6f273d3fbbd3f85c7decb13455
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ef3497384d8b52032a1fb058f55258277ff24c41ce725c23cf20f3313256c35a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 16e08d3219d0c94c809b59fdbf832a85528584f650e63fe3a7a6486b89e6f362
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c111dbdffb4c38e082a0622ca5962728d68c6531d878eacdbbde9a430199c5d9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e757ebb6bb4a6e3263652711f06d4fc80fe9cc4beb2de3fb8257812b566b6861
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0c8d94badeae5c7eff742a24ca1aa71b75b8ca47515f4601de3998aaa756111b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7d5cb65f13182a55b8e17aa9ef71101ad5f4ec815dcc4ceaac64252663a8f3ca
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e3c1a9a389bba48e8660f8cfe6e481b6d6f6c7df80917691975027737a1c6d4d
          • MD5 SHA1 SHA512

          Admin8

          • Path C:\Users\Admin\AppData\Local\Temp\Admin8
          • Size 8B
          • SHA256 9d9ae9faeb32bd20835cfe896d84e2619a0b63e3e1fce96f1d474bdd9eeef679
          • MD5 SHA1 SHA512

          RES7E97.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\RES7E97.tmp
          • Size 1KB
          • SHA256 b0855556ff22e5531e26d40224f5e7ac4de9797b94bd17b10b72bc5ebab4b728
          • MD5 SHA1 SHA512

          42267.exe

          • Path C:\Users\Admin\AppData\Roaming\42267.exe
          • Size 851KB
          • SHA256 d2bc78746034b953b8503dedc70adcfb3379cfe709d600914dba120cab8566ee
          • MD5 SHA1 SHA512 SSDEEP

          lshss.exe

          • Path C:\Users\Admin\AppData\Roaming\lshss.exe
          • Size 16KB
          • SHA256 4e67142f80b518653e5072bb38773cf958cc001cf546a8e508b2e40bae42344e
          • MD5 SHA1 SHA512 SSDEEP

          1gt7xp-l.0.cs

          • Path \??\c:\Users\Admin\AppData\Local\Temp\1gt7xp-l.0.cs
          • Size 4KB
          • SHA256 fa125ed8e48d596788a8ad5589bc996b918de3fc27008bea888b9e1b5efa2193
          • MD5 SHA1 SHA512 SSDEEP

          1gt7xp-l.cmdline

          • Path \??\c:\Users\Admin\AppData\Local\Temp\1gt7xp-l.cmdline
          • Size 206B
          • SHA256 e8499f0a6e0e64cf0369cc0cf0a6d9468fd8418acb3325dfeee045558e20017d
          • MD5 SHA1 SHA512

          CSC7E96.tmp

          • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7E96.tmp
          • Size 652B
          • SHA256 074ab1a22e072db6eb4edc28f509abfe01e2966c55026e7c471bc753331dff9d
          • MD5 SHA1 SHA512

          memory/1748-9-0x0000000075350000-0x0000000075901000-memory.dmp

          memory/1748-16-0x0000000075350000-0x0000000075901000-memory.dmp

          memory/2660-48-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/2660-24-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2660-25-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2660-20-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2660-23-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2660-44-0x0000000010410000-0x0000000010475000-memory.dmp

          memory/2660-115-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/3068-49-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/3068-142-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/3068-50-0x0000000000570000-0x0000000000571000-memory.dmp

          memory/3068-116-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/3996-2-0x0000000075350000-0x0000000075901000-memory.dmp

          memory/3996-1-0x0000000075350000-0x0000000075901000-memory.dmp

          memory/3996-136-0x0000000075350000-0x0000000075901000-memory.dmp

          memory/3996-135-0x0000000075352000-0x0000000075353000-memory.dmp

          memory/3996-0-0x0000000075352000-0x0000000075353000-memory.dmp

          memory/4284-38-0x000000007239E000-0x000000007239F000-memory.dmp

          memory/4284-39-0x0000000000960000-0x0000000000A3A000-memory.dmp

          memory/4284-141-0x0000000072390000-0x0000000072B40000-memory.dmp

          memory/4284-40-0x0000000005940000-0x0000000005EE4000-memory.dmp

          memory/4284-140-0x000000007239E000-0x000000007239F000-memory.dmp

          memory/4284-41-0x0000000005430000-0x00000000054C2000-memory.dmp

          memory/4284-73-0x00000000054E0000-0x00000000054EA000-memory.dmp

          memory/4284-77-0x0000000072390000-0x0000000072B40000-memory.dmp