Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2025, 15:56

General

  • Target

    JaffaCakes118_83d6cd97d67472203e3929c41fa08047.exe

  • Size

    769KB

  • MD5

    83d6cd97d67472203e3929c41fa08047

  • SHA1

    94b913e12e701314fa642f8670531179c9d9ebeb

  • SHA256

    de0d44b22c9a7b31e10b05ce71a2437a5338152e83d5e4cf8d0456fd76b0b151

  • SHA512

    95d0ca8c5acade04b891263612312c373ff8bd8f0406d72d05fe38902933acfb3a5241811818b18c349acb32c073f5657cf51f0bb40ef9ff1db8859719efbc4e

  • SSDEEP

    12288:yqc5slzLDP7UKL0CvMhG5GEL3i2/cuhjQJIuS/s8TN07bzwiBNJJ+bQ8wKkixxcQ:tLDzBQEf4BybRPjsE

Malware Config

Extracted

Family

cybergate

Version

v1.07.0

Botnet

remote

C2

127.0.0.1:999

94.170.208.173:5151

sadw12345.zapto.org:5151

Mutex

18740P2I51IKHK

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    chris.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    webstar

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3592
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83d6cd97d67472203e3929c41fa08047.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83d6cd97d67472203e3929c41fa08047.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Windows\SysWOW64\wscript.exe
            wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5360
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
              5⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              PID:5440
        • C:\Windows\Temp\svhost.exe
          C:\Windows\Temp\svhost.exe
          3⤵
            PID:1648
          • C:\Windows\Temp\svhost.exe
            C:\Windows\Temp\svhost.exe
            3⤵
            • Adds policy Run key to start application
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1932
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4844
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:3420
              • C:\Windows\Temp\svhost.exe
                "C:\Windows\Temp\svhost.exe"
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:5632
                • C:\Windows\SysWOW64\install\chris.exe
                  "C:\Windows\system32\install\chris.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3604
            • C:\Windows\Temp\svhost.exe
              C:\Windows\Temp\svhost.exe
              3⤵
                PID:2896
              • C:\Windows\Temp\svhost.exe
                C:\Windows\Temp\svhost.exe
                3⤵
                  PID:6012

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

              Filesize

              224KB

              MD5

              c394d0fb06a4c17a3fcc10470970d404

              SHA1

              0d09c5f507ccd4cdbafc0f24e82169096e8f6fc7

              SHA256

              5f5b8d1c671e9f6744bd45244ed9c35f4bb86fb5e87f2e35a4ebdf0d9c500eae

              SHA512

              83e46870a08bb10ca7d506a0a850d887fcd815ca01683c6bd1db7584239445e18373b430d7c48fd60cdbb35b3149418953ab0431146ab345e6385851d649ec0c

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              7d9c4ca9e0ea3f5f7ccbaca3e81ce745

              SHA1

              380b7ace562a1ee66be38065ad6cbb95f441cc7e

              SHA256

              c6ab94a8968851dda2bba3444918fededa5ee0a0188bed9e7a9d591f05c3d066

              SHA512

              5a18cb781187c47a77bd7b37d0f5e856e0eeebe7eafecd32866c303df6cbdc624d1b3ede3318e074e1d0f38d81e99272599a99f2211e0ec0533d0607ce8470a4

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              3987030c9cf3134ebc5014533c071be4

              SHA1

              6e541b2e0675ac23d7e122b05b89c8addac55ce2

              SHA256

              97ce0fb47a61331408e1919b89fb2c769a2759deea314f01647bd2ffcfd55e88

              SHA512

              9d8337856a9cc0f22318c57688b59d242ca9ffb083856ab13427d3987235b1172052b52de451492eefdbcbf411fad0bf3ba62053b59a89b102802098c2e47557

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              c237008f23c4c51bc021aa8dd8fff5d4

              SHA1

              d57a15ecfab4c280a07c77c33684be246ee0c632

              SHA256

              e23ea1db43f172d3df214661588421f67b713c8036de5d52d7cf6d1ce4b13f6d

              SHA512

              464fd73a9204c3fafde2e2d96fc9837f11965bd0b69e8b7a7ce30d8e3f71f99a5aa4a2081387c65b7642b5180b4d7c73dfb16f1d6f97bbb54196eb223e45ff66

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              8c41a3cc31d434f5805dc2acea3c034c

              SHA1

              3471350d01c58fdd2763d442551708f73c78ec58

              SHA256

              6a14f3f2cc23e2fe968a4eb9d9a6fca700118c98a42f3bba6e4165ae3b6e247a

              SHA512

              25c519d5894f1380e9e6eec013582534a464bbf88efaa1a9d1e1c1cd48306339d8d6b3a803d5368f34f576fe42e06456544dd0fc4cc6e3bac571be01d74b7831

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              c342302c621502c7e7de314ac007e1a8

              SHA1

              d3a714ce3c0c9d11e228cb43ecfe69c0695e75d8

              SHA256

              715d81659816db75547c4ea007cd279e3170711d43ef3936677034276c805a28

              SHA512

              9f558e5152e52c7863b261fc8546040527c7a12733db33ae314ae3b6c8414409ee9ae4e132c2e6784374c875fc47823837b8c052f12e5a83673bd13a8aef8027

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              517f17fecbd6dd9fd88061f1e5ded48e

              SHA1

              c7b855a085b1e06f66024b95b84ab633f4941df2

              SHA256

              5188406434e90b1396057ce3e1aaa2c39b734f434ae1da4a6e993feeed96ed5c

              SHA512

              dd280c3732aae474c9f7e79d36ae927b125920ea18b6c0a873b6dba9cb3258ad6cdf4fc18cdf76e92c4d49b0a1ef1e691615ce42e0b30f4fbe89c1e224a2f1f3

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              155d2af6a855e56b33ad6d315e99b367

              SHA1

              bfad5d28acff5f05229122932fa27a5fd00e6f04

              SHA256

              84ffd9c79fb444295a4a62467cd32492dd73cf82f5e0f636d476758686909399

              SHA512

              56d569e3fe0bee973b015309b0bcf381cf20f33ba4a0f2b225c5174798f4e60069b74c5a91a075f171dafe233cce565066e015f3e6f55011baca48b66de50748

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              d0d2e1d5a825a340594d6a71898781e5

              SHA1

              f88d515ccbe00f5211bc691b8ec18078e7d5b78b

              SHA256

              16b05040e90c8d54dbd2fc11ff18dfd6553606e3a35b5e765cae9fcab84a4d5a

              SHA512

              12ec8ba3bbf420d5dbe40a64aec85b8f1cff86679df0e7a862ba7cd6ebb3cd1a6106c340d2c8297f2d933dbabdc3ae43953a415fea5051a71d2d8fbd37762060

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              169ad45cf0b5841136366790c8e8f7df

              SHA1

              5f57153d446885105133c0836838f75a7863b810

              SHA256

              dc286eb00f47b399d6539158b1bfac54afaf29ab24f31f87f98975f51ea0fc04

              SHA512

              3d63c45b909744819df1804b95d784d18d3cba57b1bbc39d90132f0d7408accdc95ef71d4799fe3dbe103ff9450436de380428d60dcdb00f7943d7a637aa9804

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              3f0abe9e6cbd3e9752c98d63bd79a3a5

              SHA1

              62cc76bacb74f990f6dc5bf68ee0156f843f52c8

              SHA256

              b0d8fdff5b566c2d27fbf8ff815e64795e82879f236a32d12882743016b6afdf

              SHA512

              6ac8fb3f7796ef5956ba91390479c040b9d4404dfc5c5aba3d1ff997d01b5602f09c0e38564028204fa62d4cac7df0fece11626612b55a1ddc405cbef1890820

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              10017a13a30968483e4fa195c2c0c12f

              SHA1

              4662d26c8b6aecbe4a9a2baf36744338e59e498d

              SHA256

              6852909fa4ac921b63b5917071ca682c6e229ad3cd55941b084d187e3ae170b6

              SHA512

              7eb781e2bbf31526140b7817b56ea70b86153bf7fe2c37404bd14741ed1ff6ffb11ef6a54fbd1b1736ec45d93de961510d6b2e7ea83151246fb10cdc24c305ab

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              0e3e1ee54de2fd4019a233ae7f73b41f

              SHA1

              b47d4d058dd8eedccd7ff5d561b9d66577627715

              SHA256

              20200181e4b118e55b96ee3e6ad229b8de92e4378d8ed0f29eea37865f832dfc

              SHA512

              fb52ec66bcc9f483dc4a9dddab09a8f647832153fdc55d16307e2384af7f766706dd76bb13a23767df72991bcd26345846688dda5b497a3a4f84894cb33b2234

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              222ee1427703af39a53d8080ac2ad6cb

              SHA1

              8b9f37d959bd2076ea317d7197d4d4c7bec6acdd

              SHA256

              458a5ea3365344b211c083a703439664b147140365d2b665e3197a60e1451e91

              SHA512

              955c4af9903ff957f3bbac1dbaa3b6389c0a5681d82731088fbeeeca56789ef4c4ce2906413d55d130e471f96829eb54f6283b8b2fc4fc09c1b0bb6d6543b83a

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              dc682fbefed4bf0a290446e9aa272061

              SHA1

              c49ab026b6f277253ebe40ac7c0442117e7418da

              SHA256

              e744687725627e22668db33f7bcfdc5b0b9847b84bd3b8dba2ee94c452bd16ae

              SHA512

              18423e5baf715b0418dfb02ff711efda6db9f0fc8faa8f8f3c338d21ab4db98c5ac45a168e72e9591998fd4eb2a01848c3be3ae8b094a8c2048709c6ba09383e

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              d578d0d82bc8df8d9cd55b3bcc385f86

              SHA1

              ca35a98b7dc9c3ffd81a6917a70fd1c27bbcc942

              SHA256

              9f07fc93538faaee044d17f62c8160329e3e687fe78b1a658279d99312633bd0

              SHA512

              f557e1b9222c4e97a50a8a0b81df805aa159794b792aaee6b66bd865a3bc6bd127eb2bb4c46b2b9a7f58e7a7d97f896b995152ccb4a6c364316cea728dcfaf23

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              d2ff3f801dc8e9864eab5207ab09861e

              SHA1

              6ae70179e39b59a6f66e991b6e8b7989f6607f83

              SHA256

              c2cf8696cb523fadc7239499b4150dbc5720039321cfbfa12b75a7ae096bb466

              SHA512

              3d831e4be48f29e158e9bf758cf21197f745d83028bc640459349f29a645664344cf0b1063032f3c7cacc661d126ab9b1506f6147997196791e6ca75372ee5ec

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              ff00f2e78b1af897249c49ea562a4616

              SHA1

              5849f5ecb454d632882d2872c02189e875baa81e

              SHA256

              6c7497e01d3863386f2fbe8a80403ceca30fcb3bb06dde0e49aa4d1fb8bd8928

              SHA512

              76b8b5dd242889cd39294acacbff05bf4f9052bb52d451f1cdcde25fcebece25b1f02bef638fe9187976546e047d16b147ba04f2f3b4612e79d4dbbae3c67f20

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              14dbc7f8568df82b6733efef78904673

              SHA1

              175e0c7658c81efeb11c60e0dc481930b4babc21

              SHA256

              c9ba462b12f326e170ef104f764828c903f0ef6fedbf9452f67da439c60ef7dc

              SHA512

              f93db1b3a08a10882cf094ebd126df665e4f946508c4b7510ff7c16aa32c89da19f47b2e1ce31fceea0cce1381068eace22680d366635ca27c03db3202561b07

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              77075dffa01a9510983c2ec772a4df75

              SHA1

              552cd9156a8f91aafc99fb22706c9f4c247eb8b9

              SHA256

              cd69d9c1910744fa5453334d72bd150395d243e7e0d8414be633b88cc58ea922

              SHA512

              269048599db6d864f7e934f9e1f49f95dac7e198089bfc662b7c6175a5d9ccaa3f6d1839eef413cd40c71050e956db54ca768c30e64ef2d978a6ada458c6ea77

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              04573523f26c715de7896892943014fd

              SHA1

              d6a95b1622438aed1874a2f7fdad4368dcd89cfb

              SHA256

              f473ae75e1807794b71aa638640c051eb31739e14778fab5891f55a46d8fe678

              SHA512

              26bfa2ae2ed93742de8fcb3a79ed5cc5bedb0837f484ac78d5b1fa85240d891250b003af416dce41d276a66c9158c469d4cd302bdbe8ad70a09606fc1d3985b2

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              1c6fe4f6341e869bf44c4a850581e017

              SHA1

              033f32f25ff325e1a3108c53186132dd4b2490a2

              SHA256

              4915bb7287938044b732c78272aacd44bda30fcde782d82a80a6f0606ea8749a

              SHA512

              5a0cb51729aee268b5b6637ee839cd92d04966e17f8026e0859cd813838992a3f8474f4eba1a9a64d44110178f162509869eb05b80b03c7eeb1337cf397607d2

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              e62526a324afdc6622bcd224f0db7164

              SHA1

              905172ef30f1624ba9cb61c35fd67589e7d57a33

              SHA256

              4f72499c36bdcfc901304d8e322bd85927d97c68990f3394551e60fa31c257f0

              SHA512

              82f56163cb02a17423ac5b8dce3c38b7c51f8fcd53d1e14ccb77a82cddd1e713bbbd9caec1ed31d5572a13aac8ba1dedb5dfdf5983cc4375d392de2a1f0358b8

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              ddf08c5f2737aaf45a1af64977007bc9

              SHA1

              2736f2fe1633227c87834b95dc275fd9adb0bebd

              SHA256

              2b0542c2fb1fe80e9e310d281fdf37173836f679e7fd5e2588d22869eca2ab2c

              SHA512

              4e34f7fb4cc5b0838741a32aa63e18d60facce6fb174e36e42144c84138a5f0e1a188b0d6cd7e8bd26b9f66d56daea387dac749e7c08c0293059197da06af01f

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              52de48b3c152c395a2e9ffdbae5d3dca

              SHA1

              3d0556e3c3e9753292d4e44a4f0a422492b74a45

              SHA256

              ad95af32f3b9751a0ebc09211e889c19f60e0bed3fbba9abe673a1be301aff27

              SHA512

              926855ff68c47de99caa4f3183a62c11bd6f678290140ef0d14b314b1b245b0dfc2628eea38e7e0eb1555edb76091fb83affc08be7c44f88458eeb26b5311040

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              9641d5e35dc58bebeb588793368926f8

              SHA1

              62d2ad2349e945d56ca509dbcc79aead86fe1421

              SHA256

              cdbbd2f92d321e331524efb023078ba48580ddc86cbebd17fe9554099b3e1483

              SHA512

              811922478190b8da6170c978ea43834bcf775f860687c2192ed3726a8e1f403ef61b1683412799ff51928e5f890fd87d849d2a9b4b02883d7b80fc49cfab1231

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              cc93c66edbfb809c475736b4ffb6e8d8

              SHA1

              699ae20c1241ea19c8ab1f5560bfece5d1d19e3d

              SHA256

              0919359160dca41b320639facb543d57a10d8aeae84c29c9fd8d014ccf5a3d32

              SHA512

              44d56e64b9fd7874fc9395768d6751d9706ef739f54bde5a111374719e4f1abc1d04cb2c872fee89709a75dc3ee90c84aa22359c063f0a851082efefc52d5aaf

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              dcd49e0f781c8aee1bce32733c6e134e

              SHA1

              6be2de93f64f4891d98f246918354b5c33e9dc39

              SHA256

              40dccedf0697fbf83c6171aefbdbdf7c17f9197944959f7159a2b072a5b5a885

              SHA512

              03e59c11354a574306d5ed0badfe3fdda4c300d580a5ad45ea64bfe8ab00657570ed97d5f32d92c05beec1858e82c6adf412959355b035d9e7837b9de7e6880b

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              cf1823a954839d5a3483f56dc8d46af3

              SHA1

              6e3a0cb113be976b9b6a266759cc5a9f7ca72d1d

              SHA256

              dc2ea9453f295aa76348ee982ae177b0e6cb6a7f2bf8b458f4061bb1db2f6ed1

              SHA512

              4605dec87b50acad9be195b83d932f5ad94083d8370ab95785573fcbe7f2a1d32c72c9fe079287c3cb16fdd166ef47f1c1e6e9e39bdcd491e709d74b27cbea0a

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              3b155e129df590884d84846f91ba464c

              SHA1

              72b4e65abe65809b16133a2339224f88bf1c2b83

              SHA256

              c79c9fede8e73f6c19b3b034b1e92e1bfa96bc65fe588c81ee90502c0aad35e3

              SHA512

              05661daaaad33f38e388ac959316c972d1aafdb4ec7128b6a89152876f499df44597802ebfc811aec0eb13c09f3db2b2f1ac4168837543de3f124ce3a3d6dccf

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              3c46e44ee94a2d1b44f915f9e86d8918

              SHA1

              bd1dfe4f737f693df5cfa6d42aa55d12279344ef

              SHA256

              dddcce444221ede8fd8d324e8ef5a58e9241ea492b0a05bf0eb6e4f832ecf2a9

              SHA512

              73f842eed62e232bf0097de88617485699cbaa95a24dd1dd973f3818e366abac75ea7881291de6b97e0a52ddc6ab99e316974d6d6f11aaeab16a657b23fc3d77

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              570bf6b3486b7d5dfce8dba795f816d2

              SHA1

              d567546d0b86c547bacfba81a66ec0e751e59b71

              SHA256

              0c6f033bb3d98e657ce5efd813d9128e46013dc896c5b22e8e189550484d134c

              SHA512

              6f9ea740a74ac65d82fd1484aa996b9557ccde89fc5f6cf7c4e5682b4ef8e8b3bdf25b1aec2acb363d5371c6bd226b00b3dc299f2533f62a4252cea69ac3fe63

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              2ace0fabfdf9f5210472219a8e84c514

              SHA1

              06cc00d816c38371967dc7912da87a7930ab1b1b

              SHA256

              bddb3e885ff92e67f638b74784c1386dd8dc454c59f89dec620a752976305a3a

              SHA512

              a4ce16f1bbeac9573ddf764a78288ea08f090ad37019bb30152d35a8f9ab17d1652a6b7334d5fde3a9d1917b2ae100c98b9bb2e50d280ff6f80ccb6a11f78ff8

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              46c8610b117b5469ce63c929601b8377

              SHA1

              6682bab2a73dc3f72f348f507ce19032b7445199

              SHA256

              84a7d5510f87ffcdf870ce1d7ae610df6fdb07fbc25d4030d880a7c0bcb0eee5

              SHA512

              52814cfc7c0bc4d2c66e7f1f4b632f8b4f36e43a19f69081e45f1ace1cb29a5389ad01c1ebc63a8eabe5c8185de6bdd97b7b069ff5fd3ece5f9365124eff0d65

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              123c44d774f035c4b5917f66e8d22cb1

              SHA1

              957d5a17e69f349f90f08b74f5303928822a357c

              SHA256

              952d1b946cc7f70597fd9b5d910aa5a088de6cd297002d8de38ab60571c4b067

              SHA512

              d0f05226939e1b131c6f03fdd960f210874ba349e4c222b8f456c087388a9cdaad5666454acf80fcb0b1a6929f52f4921a55f33ee17d4d543f64a1631ef52c6f

            • C:\Users\Admin\AppData\Local\Temp\Admin7

              Filesize

              8B

              MD5

              5561ecb65b17608ea9020c7e7b11dea9

              SHA1

              449f404d8e8c319fe428adc0dc2f522d995c81e2

              SHA256

              38a057259ed299d899abc4d48fcedea235b9d7681991673a9c049cdeb0fc9c07

              SHA512

              5de17a5adc5cf8fe60782b5c05360d0aac808fa09fb3a35b88cfc8fe08bfc37ba227d44d5f39bf26f7c224a15cbf1412dd9ea723b0974a570b71c3a21db3f271

            • C:\Users\Admin\AppData\Local\Temp\invs.vbs

              Filesize

              78B

              MD5

              c578d9653b22800c3eb6b6a51219bbb8

              SHA1

              a97aa251901bbe179a48dbc7a0c1872e163b1f2d

              SHA256

              20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

              SHA512

              3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

            • C:\Users\Admin\AppData\Local\Temp\java.bat

              Filesize

              47B

              MD5

              81bf5400486e5da45ba0c6c1399d843f

              SHA1

              d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

              SHA256

              d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

              SHA512

              ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

            • C:\Users\Admin\AppData\Local\Temp\java2.bat

              Filesize

              151B

              MD5

              ed28c618f7d8306e3736432b58bb5d27

              SHA1

              441e6dab70e31d9c599fcd9e2d32009038781b42

              SHA256

              d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3

              SHA512

              4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

            • C:\Users\Admin\AppData\Local\Temp\rundll32-.txt

              Filesize

              769KB

              MD5

              83d6cd97d67472203e3929c41fa08047

              SHA1

              94b913e12e701314fa642f8670531179c9d9ebeb

              SHA256

              de0d44b22c9a7b31e10b05ce71a2437a5338152e83d5e4cf8d0456fd76b0b151

              SHA512

              95d0ca8c5acade04b891263612312c373ff8bd8f0406d72d05fe38902933acfb3a5241811818b18c349acb32c073f5657cf51f0bb40ef9ff1db8859719efbc4e

            • C:\Windows\Temp\svhost.exe

              Filesize

              1.1MB

              MD5

              d881de17aa8f2e2c08cbb7b265f928f9

              SHA1

              08936aebc87decf0af6e8eada191062b5e65ac2a

              SHA256

              b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

              SHA512

              5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

            • memory/1932-22-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/1932-21-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/1932-23-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/1932-34-0x0000000010410000-0x0000000010475000-memory.dmp

              Filesize

              404KB

            • memory/1932-38-0x0000000010480000-0x00000000104E5000-memory.dmp

              Filesize

              404KB

            • memory/1932-170-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/1932-16-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/3228-183-0x0000000075292000-0x0000000075293000-memory.dmp

              Filesize

              4KB

            • memory/3228-184-0x0000000075290000-0x0000000075841000-memory.dmp

              Filesize

              5.7MB

            • memory/3228-871-0x0000000075290000-0x0000000075841000-memory.dmp

              Filesize

              5.7MB

            • memory/3228-0-0x0000000075292000-0x0000000075293000-memory.dmp

              Filesize

              4KB

            • memory/3228-2-0x0000000075290000-0x0000000075841000-memory.dmp

              Filesize

              5.7MB

            • memory/3228-1-0x0000000075290000-0x0000000075841000-memory.dmp

              Filesize

              5.7MB

            • memory/4844-40-0x00000000012C0000-0x00000000012C1000-memory.dmp

              Filesize

              4KB

            • memory/4844-39-0x0000000001200000-0x0000000001201000-memory.dmp

              Filesize

              4KB