Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2024, 21:45

General

  • Target
    1e14d1eb69a2c51730c1c93c43be97c3_JaffaCakes118.exe
  • Size 1.2MB
  • Sample241007-1mf7gayeqa
  • SHA256 05c7e923fefd7e2aae251e88dd23e8b34e4f98e2c9362911de515cf0ec3bf5a5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • remote

C2
  • freshprince.zapto.org:82

Mutex
  • 6L2Q087M8J04OB

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Successfull! Run the install now...

  • message_box_title

    Crack

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • freshprince.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3484
      • C:\Users\Admin\AppData\Local\Temp\1e14d1eb69a2c51730c1c93c43be97c3_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\1e14d1eb69a2c51730c1c93c43be97c3_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          3⤵
            PID:4040
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            3⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              4⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1596
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:3652
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:4520
                • C:\directory\CyberGate\install\server.exe
                  "C:\directory\CyberGate\install\server.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2352

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Admin2.txt

              • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
              • Size 224KB
              • SHA256 cf8c837671d168476b934c558c00efee0705416a789f640b1a53fd796a50db60
              • MD5 SHA1 SHA512 SSDEEP

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c495ee5c6e14585e74cc29d3a07da34a96cf6202d1f3be1a872bf9e1e88f16f1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9412f25149cfab35ef8f33ea2036c681c6ecf354c22395161f9e600bc8d761ff
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3b6cfc4b0b0e7189ca9345e19c90cf6b4d25b7a0b51bc8424791977f80ab6b50
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3cd3639990fed4c516f8c3ec501cf4ca2baf1bdf5df102856cf068b09cedeedf
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2fb2f1e4bb45a64c1befb6e9b1dfc09214cd370ee73970c5e1f375081d456571
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 11a1aef7a0cefbaa2e036d8dda9be72bdf7dfb881f6d36d734c133c45699a30b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f345d7a63a9353d63a62c202101b38f8dccef87598e30bd1a9ca4f941e0c14f9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f136e0ba10f5c306bd598d8a484ea047b5d12546641fcb920065d1bebbe2cd64
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 dd0c0ffe8273a2b6375bbede6f2e27698841dd12f01d511ca58701c3525fc141
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7bd209102e29b7796cbf3d3f68de83a813190d4ceacf4d6572a59793be35edfa
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 309268ba1db147a214a11140feaf43bb4c39230c7170b436ac3df16e4854b780
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 457ea23591efe506a6700d7ea85dd025ab712f3f283de7e5eec5197adebfaceb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8500399ddf0224a147540db6ac050bfc8a68233b4ffa61ca39a8018ab9026a14
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f140302366c61932bd677bf54255f1e4f906f1b58c1813c03020ada2cc7b3ee0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b3f3e807bdefd488df810e3f96c4bf698c0a8eb529da497849c6fdc9903e6fe0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6dfb3d11a3ee64d6e1f6b05f094836ca8aebba8eacd938f5421e9d6288b2d827
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 616ae853ebc78acd7afc182349385f15ef0b148625fc24243c006d8b69761285
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e7f7d240b7c3b82abbcc53ce2313179c785fd055f095131a206d6b58b170c013
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 99c19077d7d236208311994784cd999857055f24f5c110a80b83e843ea9adbe7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 775632e6a22035df177de2cbc99f9b5ffea6d35b21699518b0850f25db4800f4
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 48fc19d33e61fbf5e1e8694c748fe786414e3ab915089f655d410dc22cad998f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 395f253480479776121af72d3d8d35f51f1c1fae2b9393c9d31dcefd74accc87
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 343ac75773ddaeb6d7d67497de03551ffc1ef6e7bcb3bfcf04bed734de7ddbfb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 90c55e92283d483ca13abff67e75e90382830a9514b87b77e8851664c67d531f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1e43328187cd3abd4abf79c3f8b69d30922bc60d8bbe23f738a6cefd926469bc
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c419fd6efae82a084f2310314cb7cb0f29a5197cce3f698ae43e23056b01536f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 61d1385e50b2684dd3b489051cee011b3f02e79853e238859b6b355d8f2609ef
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d6a60f0fc5abbb98c3ae12ee14cd0ba180312f6b12e72d0a52b1024d7caf090a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6772f4e61cb165c2d4e5eae63ffa4f35d46410eb0adaf17576adb95aed4f594f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 0141fa960f91f233883d54a06fc1a6d1156c70090d70f7473038a4253c4fe0fa
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 92a5ca1538de92ba1af1eebadb6731c773053bfd010dfbc13a6c3b81557ccda6
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 48c1cf95a74364cf94b334015bd7b4f137b39db4f3c9537bcca91bea598f1440
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c16db31e4a31422388849a75ce4a5bf40a825e52cd2ac2721c01b3b709fe67d3
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 915fe1b84e9a720e4426b0835448562b5b740755bd3a69b90d203f00f71cccf5
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b530c90c03566542da9163ef258f53bf10be8aaa3df56840262b2f354194ba01
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 61aee1e4b701cb884f91ef14622e25a0f9e99ccacec2e98edcd0942c86387e47
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f6580e5c3fb635455ef0bcfd8bcee3ac3b980629c2a8dfe73ca999bbeedbec1c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 73864d8457eb9f57dde67c9b2efb445e75a11b6745ae0d4e2b5a36aa90a6156f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 be56c1d7d39a9f9d1abfdafaf01236aa33ec127f5c620996a3629fd2c29573d8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 14d304167f50042331e273980b7b0bb8bf6c45479c13e8a9ce30f81a117fc31d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cb832e1fcdeef68497fa1ba5c32a06304f2feabe5c4434c7e3da80fdb381cd52
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c2bf7cf4ec5a70000a02cc47e1a602e33fff03c8e1f40b06c6e2383bfac7fd66
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7ab9f8a50bd2a22709bbe3ba2dfe1dd1c841a0088e6899b52d4a1c17a8506dee
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 69c60a707e60042494cf0e7c0da18fe08a1899bfc666544e5a70f62e49dc5140
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 53004f741450390f0a62512f7d88fc262c484fff580221c7bfefd5e529fe3ab2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4ff163e4ba2f9a9807be4b2a77a9a4e71057929b8dcafa70159752bc63fa159e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 eb469aef2205fa397a2f1f5894873f5c86e4530f50ded0082ad1e6cb42893880
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9dac2d3c55caee3285cb50c20e2f96b4720df36eb720e7326765cdb04e881827
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 433f0ded06f73fa59bb3b18247a810de8eee9e3aa9450761309e1a840c09a5b5
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 18ee1908d1dd78e3a99eb508de35785eaec29877f9db216e47db4459c957e246
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2a0e49cde649c9ca9771f3227d2dbd0f3845a69b7e7b7d79846f31744c15e6f2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 111b2e235e8313e75b866a88ee47e716f002477e290622f03735ba0eab62cc6f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 645af85ed9a443a70aa8465da7d9a92542e289affc7149c25b43c51eda2476e0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 908916d73bcbd609f30cb0a2f3969377a0cb8ebf523ddef27b3fbca09caf8f62
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 64ef61b333f5714e102c9bc9c6f025a5b602087def65e592cbcf36962fb6765e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 34557b36e1202b99b9a5f1d6b89c9c8b5ba8e1fd26a027a2289bc981c333edf0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7355eba85d45e1a0d6c9ede2a55f877f3bd29615ad5f35d8f3f102c36b5fbde8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cc1e13d40b783537e6129cb33cf3e01da18d0c5ee0a028f3df973f041f9f2692
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8240ded072b1c56decd8c377b774f38e5860b256c390df11e4400fdc3dcab6f1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d776345c8abad02461de40b603045a32fb7fcf881f93b6377b38ac30e186d21a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 70d679be8d0492db18af020d0ed7df31f45fdfdaf14fea9b77551099c4744cd0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 549c0c275f43a6f38a65f887a2f22be62ae3b7bf44cfb290e2a6c194ddcf406e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7fa6070527354dd9fc1b9a02bc6529cb14f9b7492638af65e12a4ffc7609ba0c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e9772f5f01c318dd3c612a877b2452ad85be511686559deec830008f5332916b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 148beb974d4ccc96f6dded5b607cf28b1b5b187a95561f68aec612b29602b8d8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fd24de0da60b99aeec240d5dc869cab45610d79e87661b9e00f4da137f1a24da
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b28eb0036673f404554a290ec2a908b0fc107361498f94b967f1f496b37dc899
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5732651f9a87d2ecb0827b1305008d9b1aa74fbe34c2acd2ba61c0a32c41cb67
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a4f912f1744657e80125d69a6834dc6408caf5ed1e734452095f35144e1ca022
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2776e5df97c972a945adf23ce92b0dc29f1093940ed7b78cdc258e0290f64c95
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 58f80e7e00228b2ebec5b8f670f0ab530cc3cab0cfce0bbc3bd086116b4673c1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ec82dc241798fe0768195fe5e690a6c04dc97eedbfa80c0d3020ba392998f1cb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cf25ff1387879349228a18db4b523036f61fc8e15b7c2c40267e4620178cdbe2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 75f2dd505cebf93dce5ca882386607642eeb781ddaef193d6e79da1e5b4f3934
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b6fe7db1f6fcacef848f6043d974e4046e62d60b12949aa9fb194ecd994929d3
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ce66da79b8d22a8cb9e8464b4f25ace3f6615bef556e23eb701cf7397d224632
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cc56d2c7a8f0fa78d7e55a1dd83fcc042e6c33bebeff47c080b3515727958c92
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 30cd8a9e0e5e61721b3c744e47351a2649f571be1e2877ac070a4a00501e2643
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 dc59300fe0d8befbcc815006477bd0e6569ad803d95c395069cc18563584ba4a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9fd399c990e9f53272b6bcaf43654c14a9a181fcdd25f703aa3f2749c542f4de
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ea542c56c273e4674b30b7b7e16dec8825e70a75f7cb91c48fdd7685404022b7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a97fb70e2570cec527b2881a5273cde5852677dec2d26da6fe9f74253e30d033
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6902809e897e1f0a0c9f2ff2bf84f5b311f93de41cefa0a45f4241e62709c5e8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4d9f5260598ccd48612a80e514c1e7e9020b66589a48dca90d897ea9c56ebd03
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 728e0429eabc81bc976cb2a5993739a3980e4c80821fbbbf64c179bd546dc170
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a0012119ceada7f284bb95abb84cf92ba13dd12f33430e89c3bee150f3684e04
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7877adf97c4235ceaa18ffa3305f022701a8f2e8ca7e3aac271d08dbeecd4865
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b872042afa61b84171c65073c4832d2bd2865be032f91ca5e5591b9286397062
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4f9ea2df886955518f6e1771a5062c052843e9393a7f8798cc722d5102b4c3bf
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f668a9ab3d241ff9dc16038895baa7d85510a4666d8f6d6a5c5fd82546b4a289
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8b450f0febd5ed934ff8f9af43488469d2821bfb600fc91deb519a108b7d6ca0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8f9d5baf6e4123ba2f9a3dfa71bcbbc8a65047f73881ea1dc879b65857f37f30
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c225012a3b7958bdb7372f3a461bac42114076c9644d5a4fb3d46a9bb2f70f56
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5be8fb07956a843173e19724a0fa5c5e64f9f0e1a1b7320dcf1624c4877360e4
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4c67b07bdec4c9d24a10ad3a768e47eec3f74e16cec67221a4a594b5b52b0778
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 355c5a3ee2e05924949901df199657f924803644748da3de03d138ecf1661a41
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 849937f7be81cff93fe23db158ef38a8fbe86c3b1632e3f346683aa7202885a1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a22dc3baabc2e4a0b2c43e80a3d35d3597617838b89d5af3a1f6f9116cc2848d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8280b48146be859f0d2d6b69fb2f36a91aa447aa475d37667091881fe1947ac0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6b79e8a2aa3264829ee2ddb00c4ec9bf26d84c4f6e83a3f7c5154dca613d287d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fdb9dc25286d8c1d292068ad554692146637115b91e6d80065476da74460a2a5
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 0e8384af2b886acdb0f205b731d3d71b2cc55ccd8097f43bc801d11ee57b3a6c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 453f256985dd452f4be046b02fa83a45907b57729c7886b4dcbdefc285b5335b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 282b91e1fa4cb09bce7d293fb66672aef1b75c8931f0ef8b04b150aab94a4044
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e0b0483628aeb97b4eae8dc0fe38c9fc51307ae82972de1d6b36627d50d94d2e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b2f418bfd72f584b71e2d74db862af39eb529693e8de6b31c67ee2f8b77f4919
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b3593be13342ad047c15351b55c9c94e08d8d4a17e0def08fb2022e31a695167
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 43ddbed3ab8b497b6157d6b62ad4df7676f29cf4dc6503ee7119b86f3b988158
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 91eb8e9a6bea3cc05cefce5a08225472aea802910f7a2324ea228394e0237028
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 af19ea51c369322838b128db957b3bcf0f28150a85d7e1a487d5eb3f4b4a8f77
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ca7a6eada9f5ba0f63d9939ae1b679a936cac0737de57db4f9163805e7728d82
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b85ca49fd5c078455d3987bdb56247dc9dab4f3d82b68fa8faf7e9efc0d02ba8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 81691085b4cb0246db18c4e866026e888b096ca217e0b563b3de484d0e99ecd7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 0915722bd8e4e5f4e7783bfa04338576c1b509b16e71e4fc355b3ef00ff96eff
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5640605855e591701745dee884c19221f672ff68db68a0b3e41a8da6101b391b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 db5ee8ad25c186c74f810432aab35290c26b5b2c0d8b4994736ee32f1ad51aff
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2015ca7b821cc5c323a14a6a2918bd1a23847b0e2fe53688adbfa54413f2f940
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5cadf1bad40368ba107a59044ea776a9afcec5e8c68628f2874f2782ae6216a0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f251443b770c9225db0332dcf6c7c7c8cda44df4b1244b0af8151bc34ed9207f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 01063ece5337d74c2153c55fb1a762ac4d007a2be2e46236a271c347b61efd4a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b9044d1ab02dfc1bfa9e681f6d2e5ce091cd4c4b68ff7e857914e136cce00b3f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f0cb65626e0aa0f78a5c7095ea28e6f471deafa9f6c511043ed1149f99030e64
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4d3592b75eaf34b135ee27b4ab01c67cd25e20c681da18cd6653a8110eadb249
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7d7ede46ab463da7de68586a866169d8b9b150cccfa86e4251e704ef6c1cc335
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8124daf269973ab1f32b16fa1c58c791a1224c9d714f03b14b88910efaa278ef
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 026d305c364d578b1de53cc8358d37f9796e09a5965d59280d2d806623d58a26
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 dbdf8818c96c730f843de04f89c8626c257afe788b96ee99246455289cb21ca0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2ef1ac012eee1cc6f1cdaea79c0490cdedfcb2995e1c48c2cbed11246589693f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fbdc33d91c7524e4ce21262fd413cc8955a6a28d5d3d645b7bd0f6f8e95c951e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6d7b8a475f480e560537803d7f8be97b86f20ce1839db41584b23e5b1e747d1b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 bb0b163c48f82a6123735566cc6a1b2680d43d7e887e9ed982c5d3c684f1e3c2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 340956e37e05d1161fb26c5b8c42c42865b6ddaddcce6fe8e8c70c9c8aeeeeb9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 de78c5e4b6f6f451e55950ed694318abd30b6aa3ab8b655936ebb402408f90a2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b63e426d29dc0b5875bf50a22ef2dec3df181bd068d6dc81e6cd7b69c3d34250
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 0e198b1f35f0542fbfcdc117e3c5e7b30b431982177b8296c74d5dcf75b16da6
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 0cbd92adef17ee2fbf72e6b60241c0d2525be02ebf83953def4f0e8e930f0a4c
              • MD5 SHA1 SHA512

              Admin8

              • Path C:\Users\Admin\AppData\Local\Temp\Admin8
              • Size 8B
              • SHA256 2e263adaf2b9d53cb249f44daa3a261674a841f19548222af34e8ad282bfb025
              • MD5 SHA1 SHA512

              Adminlog.dat

              • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              server.exe

              • Path \??\c:\directory\CyberGate\install\server.exe
              • Size 1.1MB
              • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
              • MD5 SHA1 SHA512 SSDEEP

              memory/1596-18-0x0000000000F00000-0x0000000000F01000-memory.dmp

              memory/1596-17-0x0000000000E40000-0x0000000000E41000-memory.dmp

              memory/1596-33-0x0000000074600000-0x00000000746C3000-memory.dmp

              memory/3960-8-0x0000000000400000-0x000000000044F000-memory.dmp

              memory/3960-5-0x0000000000400000-0x000000000044F000-memory.dmp

              memory/3960-12-0x0000000010410000-0x0000000010475000-memory.dmp

              memory/3960-13-0x0000000010410000-0x0000000010475000-memory.dmp

              memory/3960-74-0x0000000010480000-0x00000000104E5000-memory.dmp

              memory/3960-6-0x0000000000400000-0x000000000044F000-memory.dmp

              memory/4520-174-0x0000000010560000-0x00000000105C5000-memory.dmp

              memory/4520-149-0x0000000010560000-0x00000000105C5000-memory.dmp

              memory/4612-2-0x00000000746C0000-0x0000000074C71000-memory.dmp

              memory/4612-0-0x00000000746C2000-0x00000000746C3000-memory.dmp

              memory/4612-1-0x00000000746C0000-0x0000000074C71000-memory.dmp

              memory/4612-9-0x00000000746C0000-0x0000000074C71000-memory.dmp