Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 16:21

General

  • Target
    866098d2c98285bdc77feb7b659f9ddd_JaffaCakes118.exe
  • Size 590KB
  • Sample241102-tty8aszbqm
  • SHA256 d32a71ad2801fa5c6026d2dc37be492bd313b91822908ac1165a56f15580a685
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • filmztube

C2
  • missmollymars.dyndns.org:82

  • togastand.zapto.org:82

  • difeng.getmyip.com:7777

Mutex
  • T8MCT3M72A5241

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    60

  • injected_process

    svchost.exe

  • install_dir

    System32

  • install_file

    dwm.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Please run as Admin

  • password

    ALCOHOL101

  • regkey_hkcu

    Policies

  • regkey_hklm

    Policies

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\866098d2c98285bdc77feb7b659f9ddd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\866098d2c98285bdc77feb7b659f9ddd_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:60
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          3⤵
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1700
          • C:\Windows\SysWOW64\System32\dwm.exe
            "C:\Windows\system32\System32\dwm.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2376
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Ckzpz.vbs"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4372

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Admin2.txt

          • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
          • Size 224KB
          • SHA256 2d711078efb0e74dadf73830e2ddc4f2e17a7602391be69a58b2c2ed75e3265d
          • MD5 SHA1 SHA512 SSDEEP

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2df14f15bbdb96085629c40d068edd44a64d68b138afb0ff86a41e92119f7aa5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b71858c654f47d77dbba615ba0103f558b3b82ad4c26f201a5370346dae80147
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 09cf90cb5a259b14487af59d67520b09310bc0334bb8c0e5d7346a5483c99b2d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e3a8fbf7caf95783dfcbe65fec4f6f969b4365e00372f18e23e266b025f8b01b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4dd57f5914b914c1c4494a4058345c516f471e60d0c05765b7a6f39e21a8224d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 dd41208118bd664fd4fb6958ee630462e143981d514bdad71a8bf3f1bd5faf92
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c9935ad26637cbc46c984c1cdb37dfe1a27e1c593f107e90fbcb405fb84a8664
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f261a018700130d44598c85db6cd48116518e7adfb19f15bb486f5951d818461
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 945a2c57727713cd9a2a1029d0008eb03e5999cb7ea6fb427a88c39bba3eb3a9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 917a641a1a0a8cd5bcab29498f12b24219d1eeacdd6a9539721601cfa598c49e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 62b0512a9f0cd70b008c83843bb365231d14b81b5f2f2cb92cdd5bf8f19cf592
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c8982156ee9889d5aac7071bd53467fa4c0f23a2820a1d4a1b713675e59899e5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cb2ac91e051d8c798c78aedf9eba67b437bf67959c596d35bd9d5154dc75aecc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 32f86ce78e4d543908814fe683f372cd43238af85619279df75e06537852451f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5bfa304e13a57177a82ca1d54f48036df8db0253ee7c3d2b9726aa1dbd28687a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 eabdf422801889d76419794ae7335b84f6341cdfce39da8071d2e4257ed5550e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cdcd2d85c86fb66b980720b997608bf2fc3e3f746b0ce69edac0c3c8fd50afc3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a02ca1b8992d45ef3887df36798afbf1e9cbd486ee23f24c9194fc909335779d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 775b001c434720d78cc847bfee45d845170cf00d752d127999ec4834831f66b5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cb55147766ada1c81198b5a18c1620320661973b425b8309807724400be3739b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c9ba5b813b35a6c844f13954d64732c39c7e48ef545f45aa2c6e6e5abbac9ded
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 16ff77c0bea074f7ec3202c5f95fb8fe06c0c24d21415e25e1e829c101c1f965
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1bfae0950d12fb322508f0460a13deb378bd43ce0e7672ebeaba7f0187845b64
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 483d72eb03aabe5259cc311c288ebc81bfe466ecc8581f22557f72e4be425cb4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ec0c198632b466c8244523e347700cd341af35da4767dbefc3c605eb55ed559f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ad315b686eea20b702b4e1ccf553705b277b757dc1d0b2c7d942823360990c80
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3ac58ff3917ec4bac2b75a3f751aae7b9362edddbd25e58d94778b123f582649
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 52d2a773373d9b70a1e9497f63d26e6eaa51393e8782895770327ea0f464ad73
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d3b606c8fd0c1572b85e837dc9250e400fe1b23d282a23a1e7faa65b9c6e811b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3ebeb5521cc106ee3806ff5058de71c27f4c377158f231cc7a60e7f5784310c4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bea3c6b9a380865679da065da881d15b6a36bd1964e53989d0744bee241192dc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c02227b5b946c07a5e7fbd1a3fdaee44731a55fe62d334469e0862854f250a32
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ca42b9a565127b2e2083d4bf97f3d2684b36d41f032ebb5f14250480f93d37f8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9329ae05d389a4b2475faf729d3ee162563131851b283e8c27869a3a150c1335
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ee23500b4b9e353d7e76bb04cba7fee9b5169176218d2742278b49b9bdeab110
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d43b734f430c2bac5e7eba244e2d18dcb8867380a2a07406579f8708b3601ad5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8de3f7f50dc19ac5bfc266fa6f24e9d69819977fc86a2266ec93903c70424f69
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 003dcefe4f206b3744798d82e02293da7c908c02b429092ba07d6fd9dcfd2063
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 073ba3af2acdaf322ec8264c394967b8b52bbfdfd170470191c4a76dabb26848
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 49f13352b1ba97a880c31c92c24f495904371f38588043871dc80538c8ed091c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9c16f7b20dad673edf5f444ca19c99072ffacd74cbd88131ba35ca6536e30a75
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e4b1baec09537adf9a7d77e696b1d8855b6e2b36efae6905e0ff9f8b19367ef9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ad7851670e8427ba60ec8edba9216d36c67384dc83865bdfd0248f3561c7e748
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cd2098fe468e7377ea5e2cda21892991ad5bb6499c689b553f0d1705747ffafc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a8726b2abc3a77bfad5e161a3d40339a0aa668f1864747404a9d20d00485f880
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2d0d375b48569f839e787c3b26a4b0bcd87b1d883ee2da88b246eb1bde4f30db
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 07ea98c5b3c0d08f7602e97926fef02339d1163dde4586961d90dbd64aed1389
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ac21e1fc22ec20f6e621ef5eba4cbe517b609c5d37c8da1104b627a1fd440cd4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7e7604b1b6fa176df893be0983df16a2da460d4fd9c7af6627ca7e53b3dae94c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a8d1e410cb9a22a1a2f11fd5703b9e89a9c203d6b8ed9a1c8840276f28090306
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 63e474eda8b9f752d4c60abfd43110a4ea9426d295d56d807c142b49edacfa99
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a0d62dcb3be37c7aa7c6db060751b5d016f840487d33e68eb15156ca16162938
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0e58926b3445b9765860008c8f6a8ff0621960e5a0526595728da232292f002f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6a8547603bc2fa49903852375b9e537a234969dded7cb1548f749122f317f344
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9f429fd1728351d38ddbef68431976c8c80cbd8f5c95309a71e894d85f8f76eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 096f75b5afe0f48ff8bd7ebb90b02d629c684b5337f15b7c6bd3bd07bb8fd52e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8c2927cf217ea85c34fd75cf18ac7fb5dc88344c17ecaeef044e4f7d9b5ced36
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fe8f574fc4a34d2824cc511cc511628a9cd8e859a1256366a8c9c327dc2c2e20
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 81116a95224d6dd315b2951f13be6c0804bbd285553ce7d803d8736414355664
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fedf46e0c452f4489d34569d315dfdd568f7c020da3411b3b980de1d941b112f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 485bfd08d96e4dc9ffbdfbc706931b219958a21ae8f80cb2605fb75219c09234
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 46006e92d81e07d619114ecb0d615f4f876b46213a6e226d17107d642471f85c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c6b15fcdd632cb45facac5819be323a43b0a77dad3682bffb853d67c0d6fd60d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3c833c1bca000344c5998fb08a6981cbd084d4ec9c6ce8fad7aae598a4a3265f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 22e68fdc98e5f4bc580c678ef02d9d8f11a872ef2ec2e00469931beccf1b0af2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a31500c7253914f09f33d34a20156b2c7af374b4b7cf057bead65da1655536f0
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1b41b3dfeff26683da428e6b0b2cab7a49cdda8f198576b65f1d41392d01fcd4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 209c3574887325903ff68160d631de29dea41a1b4dd39f2334aeed2f1d6789e2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 002436f32d0d89b528f40024753f215f64d0b752bc69a5ae269da610a2d7ff39
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f2e5aa692c9405219f02e7fe989fdd895015c4638b05c92085dcdfb755829e86
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 da379c500cbd8728ade9c2a359fa07667f616a39f19630161bb8c75657180170
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0da798b7aac55df67d4de5ded962527b0b129892d22992029a449569433440bc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6f5492abe997e62408b1a2bb77b6bba1950bbb34afebbaa26e53eb636de1b1d1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a679b41c3c5aa35692e8d3fc3a5d25f9c1308925364f33f589e98727e20c9415
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f934b04f9d072d982ca28b210391ddcbf29d3d7db6ffb02ded3a5b2d1be9a63e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c7b324ed92489e5134605f3305c86f15e8ee6c2612a7400d730fbd7cc3289fa3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f09596c55972b0e0b07b7c91d346be374512933142bdd4728b825f2a3d896d41
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 30dc93aa0ebe2034fd83589048e78f08df340327e117617e06a389905428278f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2401106fa134010363414ffff6dcd058b32713f8587a20f2a195ce1cdb621ef2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 08f5ce69cd0aef0a5b488afe806e92fa9875dccf1b20d86772214980cc8abefb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 63b67638419d8017578a6a11f02dfce06dcb3bcb4ef76c23d09d283a4a9e8c5e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3dc80dcf4c48014af283aefdd3c008ca026814d826ccc62b0e24b70b5dc71455
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a0066590c6589b6576cb1af4d19f13d81f53911c9afd51a691576106df0fa3bb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0f0748f73aaf207f860a8d8c81660d0e66cc2178a4d4bed299906bf7dc618fea
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a2bf81d1813926d36eeb25ced10953bb9a65af23b76115e92c66edbd8e170ae0
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 12fd62390d8c654f0577319b0fc287d8961878875a8d5d0d9ebd04481527f607
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1ed00692149718f33a00faa802d86213ff74e86aba279f2e473567383b88c71a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 23a133612fd6a0f9c54a992f9726ec72610943c46d83c98c6dfe856a0832c30e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8d9a4bf9448dbe3d5a40f00ed98b45d4cd2e860ca91b479766e17b80b21bfa3d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 59c0a9e23323f22948912eb0cc1a445a2f94535fb5842e8e525bc001490c34e9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a33af04b929222181c5de3abacba03bfe246ee7ab05a7329c7b422108b1a6341
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 aeb5b4eb8f91848bde41ee871471946ac919e3e927383df2512bba46344c4bb2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 74a89162feca30ff549f5670f2a844b55a0f137bfbf9b3a3453676ca7ebfbc63
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 850c4ee3a0b917b87d9f60551dab67d616c548ce0193c9079b224900868f7132
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 574b71d0dfddae709648eedbf8ad3c6d31bc4c58b06346e392a49154fc9f261e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6fa87a47beefefa7715f15b2e6dfaa0fb7eedafb622276591ca0c27c38393fc2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b79895bb2ab45555ef7d3c20ec775d05c74d273d80948b257f0d7b5cd0f6c4d2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e101815db8b91fc1df2caad1448b9619f945df7e77d3f4309dba6797792a246f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6394125f427ea4feb4513dd8755690f1205ea3e09fc65863c61596dfd0da0794
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2291f183c5ccdbc614004f6ae9710da415dc79c6a440500ac3e71fb8bef454eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9e792c62fa542222b50004428c7fe77ce234ab3a50865e75f65f4d51b132e210
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9a0ae7fe32a7486a543e255791ae4ff0c183fb5d15cb9294d9f2c612990b1556
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d42a99c8337628283fe44535be262238046098222662047e9f3171d51e140479
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d13eb28d04870f638761f4f6eab07eec2cc67177bd48beff82415b754dcd1cec
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 153adaabceab713d91e75a90ea4cd03b4ddac52476c26e52807d2dfe21a5303e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bf1ebeddbb05912787cff807a5a37a99de0abb5dfc6214a0ade118f8f93a42f4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 34331594d1c09abe6e713cfd5b10c2367f2cb56ca69d6c95cf10e528a1b5d090
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 832b111e1fd56e747f9e40a90d7ae0f25f39144fe42b973e281c557295f7139e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1993656fbf778c6e3db718015fd0b98cdf85a9b80a53288743534fd2e9b63b66
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5b72f406756d42d39df89f1c75c1500992292f76a40f9d93b41ac100589e9d34
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 74de25232367421bd17d3131457bf06d5ab4c09b5b0557d9246055eb91f030dd
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 633d8417de7fddc5a7b6a3d002b6ae035c8af77ccb3ed86375a77303cbaceaee
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7d39d2294166d69284ef82a3ebac3fd89986323a092265746fa2a030d3e18697
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d0e19c9a19be5b7bb7908f06f08f402c26aabc86bbbcc87c6629a74249cce4ed
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c11dc1839f40e3fea05f5867db27dc4eda01a475546ad45fcb1e654e3ecba816
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 47e080e0682f550528d459122ca3d6fdab8b20f980678b21b9dd3650f6da5611
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1857e28624ada2fd790fa3e3c6bf42d167f690586c476ec1e803125bf3c8006a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fa281b6d80cbe4f494c41cb8e83bfda25dcf0e6f3b4930afe93d7d2f130a3e88
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b5863b90449f1d3fa0631df7108e66fb2c2d4b1188051e9f63a28906e841097b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 85500de5d03e2141de51d2e0af9480ebaab79ec33cc07df33f20d1a1be63bb50
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0132c3d4cc1ace7a1360b09204567b14130e1a38e4f44602f7090f6d9667c430
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 acda2a4d448d7d2719898b03d103add8dc1c8e34c8cd51931a63f55decda9a18
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9ccf71bdb4ffe33d74d9d9a04941208316b82e680ca2040c037fd50218693d34
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c8052a84fadc54cb2f22422968323c92e94b578391c06f8fa6a5a2ea0519a33b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 62c1f8b572c093b625868d282690dd69c35ab9888af6238aa5d35245ce575b1f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 44e2e12e7c5b4dbbaa4bcc6f3551d2d7c2489b5ff57f1cc5944f1e0d684d935e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cd78adc10d9e2041b3bba357fe139e830f36923106850f893890f0704d17ce57
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6180bdc58cd41184a7b18ed5ae4a7dfd30215ce38016717678b9edf3ce6e5d12
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f023fe588d39e4fabf635bd079baf2422b8a585bb2efbb95db2af0bdf6ccfb7d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e46bd9e8279294d87bae517b6312db93fec504e8b28971bb6696b50344c57ead
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e10263b2f37894b090cfd4366a86dc603cbd486d9cadcdff9269fe7676932b3a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 13098e2bfdc7fda30eabfb3ba85492276c835920c8bc7c152617093d847c6aad
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4e214ac05d44d0d4f164b9c9080d6d0b0681d9fb9ffe2d606bc0b3f2f8564c77
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 faabc179b0d83049c917b84ac2add11c8d3221fbc821cb445e14cf05a27d266b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 42e6b48488ff2715c91a47c12f1bffe5163c8efaf45cc376fcc545ec4d178973
          • MD5 SHA1 SHA512

          Adminlog.dat

          • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          Ckzpz.vbs

          • Path C:\Users\Admin\AppData\Roaming\Ckzpz.vbs
          • Size 391B
          • SHA256 02585a7435f8f8e5a43ba0c0f90b303e3f53bc71579bac5ad1872a62e2978013
          • MD5 SHA1 SHA512

          dwm.exe

          • Path C:\Windows\SysWOW64\System32\dwm.exe
          • Size 1.1MB
          • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
          • MD5 SHA1 SHA512 SSDEEP

          memory/1700-23-0x0000000000690000-0x0000000000691000-memory.dmp

          memory/1700-22-0x00000000001F0000-0x00000000001F1000-memory.dmp

          memory/1700-26-0x0000000000400000-0x000000000051F000-memory.dmp

          memory/2976-21-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/2976-5-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2976-3-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2976-6-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2976-7-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/2976-17-0x0000000010410000-0x0000000010475000-memory.dmp

          memory/2976-85-0x0000000000400000-0x000000000044F000-memory.dmp

          memory/4300-2-0x0000000074A50000-0x0000000075001000-memory.dmp

          memory/4300-0-0x0000000074A52000-0x0000000074A53000-memory.dmp

          memory/4300-14-0x0000000074A50000-0x0000000075001000-memory.dmp

          memory/4300-1-0x0000000074A50000-0x0000000075001000-memory.dmp