Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/10/2025, 07:00

General

  • Target
    JaffaCakes118_313e108f329b92d68b8b9d85553e9fa1.exe
  • Size 776KB
  • Sample251025-hst2eaav2c
  • SHA256 3742554e5be08bd69fd419e4642f88806b46fa12bdb60141f619e9f42f94b5b6
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • USB

C2
  • cybergate.myvnc.com:666

Mutex
  • 213V4HG7X1O3TJ

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    jusched.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    root

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3248
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_313e108f329b92d68b8b9d85553e9fa1.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_313e108f329b92d68b8b9d85553e9fa1.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Users\Admin\AppData\Local\Temp\USB.Exe
          "C:\Users\Admin\AppData\Local\Temp\USB.Exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2852
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2604
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:3336
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                5⤵
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2524
                • C:\Windows\SysWOW64\install\jusched.exe
                  "C:\Windows\system32\install\jusched.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3104

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Admin2.txt

            • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
            • Size 224KB
            • SHA256 927e7c65d5dfc6ce6cacb1e76260a5554ea4ac583eabc4bd25e58112b7b520df
            • MD5 SHA1 SHA512 SSDEEP

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 727441aa9b5e7cd63a1ffcbd133134cf76a48e4b0dc18cd78747f45702319113
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e4e5b1501c8ffc077c3b19dd5fa8c5e5a387a9e48553a622342166fdd95bc100
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 30fc49b495cad3d0d6472f670571b2b6e7ccc00f17c52736171361e5d9ed5527
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 61ba7fbd2a20bb000d20fe6554ae6594de85393ffaba16eb40f05a59a1ef907d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e0681ab09b366b56f597b3dc85f684d4660273153b842c69fc33c41e6509e9c0
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 94464e46c78048a3ae7f449cfb9a8f1f8a8270950e9c26f9c7c84ff3a86d83ea
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0474a31fea05e6f50f915a0863770c3102977e16d8fdac7d9344f15bc94c70ba
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f8a2329f840b8171b706ac703e5dd1c585f42a75443c5cd6fded87ebdfd28890
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 36ea8260698649e238adc37982453b0382c89632bf8d2d9557097892cb79453f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5b9918393f8120e5c9b097b4391d3eacdc0ed7e916e1011070166da889e841e6
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b418a9f1e95aeb69fd4f593ccd3af36550397f6c32007d3a7a0f98afba22bea7
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1d04cd0f81a7faf65cc2456411f548b864451a2d903f9031c594d176b2a7e672
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 32ec642cdc709ec54401e4184615bd04d86e33f240b6df32cbe5a5cb93b94299
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 110d6780262668cc69eb661bcc572ef4bf7a1d37403252e7f7b776233a2e6eb3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3563bb69e026d088f750305ddfd14816f6df11813f469a96a6b428293cd35f14
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0f0f0f90db50fcc54a8b196bd22ca03d12fdbe692b1b7942144e090e94ccdad1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9c0285d26058b468bf6c61b666a4c7d9acd8478dbd41f18764b0bbd6a7132f15
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 46d403290af678ea433eb98cfb1e72d6d265e076789a5fe722978bda9974d45a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e275e6f99945a9f22ee44d45d6ae2ee04c975ac44ae1c231eb51c441ecd944b5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e4fe38c4623a318fedf316e176e129c078022f7ba406b731e37a749982c67270
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 26856dddbcf25f1d2a6b33052cc272ee16d4f303ed244f9de1dbb0c2d5feb9c8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8984e7273dceadaceb92bf54d102678e79e22af069e3a5d75b74ee40a93543e9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 23ff69f694d34f0f2fbd29a70545892c5549fd3e166cfa2dc4bfb8aee4a56305
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 7385bed2cc71a4d7c36eebfa607e811bdea40c8ecd4b5d47f65111ffadb04559
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4a1acd98f9ee128d7d1399f06d3612908017bd0ff40318816edc1878d17b93d4
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 7d5177fc3e6ca26bf8c9fd50b29b38a50a9f19a3aa0d3094ec51c917f7625be5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 1b469a9e4452b8df40e993e2122dae9c3a895a31dc5abce9a8b9bed895475df1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 68df5198d2c8d3a16990f7097a3d0c72953278135c0ae74b75af1bf5397a9e91
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 360d713481629c321561c092b48803e5f0525c2660c947d06fcd8a502d86981c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fe47885ce25a1ddf4978870343c291f306d3a164c496d8d27774906db18df3a9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3e86cca23fef73720ef0937c254ddbeb35f60ee178984bde4aebbd8bb8c5078a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 19b6f69b9f363b3f912eb5ee41a3789dbe05ad92ea3509289e6a9267f5760721
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9a583995fbc3c36c0abe462a31cac515095c4f4ed4d3dc3feb30dd13314cdaf3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 59ac2f078612472c3739feee361069f1a95ced95bcb4d86da68710c713e91aea
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2c60b93865c42bd1fda6518c2744629d081a81e371d3e34e2d643d95f43165ca
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 49a8478e6650e0640fd39c4125fbf83e69ad0eb8010eabbcea8d2a42137e5629
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e62da9723e08529e4e0e0c21a3a110a27ffddf5e99cdd938aded27a810777747
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5920e4229d627117dfc8bb7d0c2258c382039dec9aee61935e06fcf7ac144c8a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2280ee7d66084ab5810e13919ea847beb3d4effa0029118088ae58f4271268bf
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4888b80a4779c5e3fc493ef2c539633bb6617fa7cb51dd10f38d0337d7ac9a45
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e0daced2686575048f9f00b1b0d1d2ce435a434abce33564f0cc1e782a8569ec
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e2079a204dc1d32b1f0d9ca07c0f4215eb2a967055e5faf26212358367416958
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 85be4cec7962494709de59f9df0657daf3f2cc368db50ee2f71e5789d0f4a0ff
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4b174677039046becd753e4058ae55d37b75431485a838fc71c3e1577b60894a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 27b7d1f81b47934aff8bcea4ae71fb14088e3deddf86fa59d057d9a82c062d8c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c32b67fe4d2585bf243c362b4bb7852109eaefa739aa339fce31fb32520a6a42
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a2f8803b25a8636a616359bf62764b5b53fa08e24ad48b1c8b11507b2924ecb8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 61d957099747a96edbe26978b3b8ec2339c435e48d61495fb6a5bc4421921495
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ed89572a109a55938b63ab4e355243df6e1ceb630c44f66d3439b1f08846586f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fb82527c397c5d869ee4f49dc728c249f9df908cf23e6de13a8ef3fd70453b96
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c12e5c93c605192c77e97cff57b668ecaf9002da4aced5a3c85c90ea1cd143fd
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ef34184b66197e7b2b40bff853177b445fa25e1632fbf0587acd5bfbc7ce1f68
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 13d10d87332bedc587e8d2eaaa86b7b3bd403fd0093dbafc8342398be52e82b1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e5321d5fe26a45b58edad2dd2228ac24f6e634c928a21c917b9da625b4c50f07
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 0ea30c80ff315fd2c5d85ed9186e24e874facccb6c10511e519a977dff3d3f4a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9a091ae5f726ead6cc0fdf1837cca9e113178bb7e63b7828f33c7b251d817306
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bb66698e760d6fe5a7d651a62a0fffe7a84c2ac225ae5f410ace5e83cb1bdc2e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d3dacd30367a72e8b26f1bb0bbc6ed37fbbf08f80e095189e585c9b1d0086d24
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6cca4032e63c8881e0d71f0de88ffbc35ef2bb7dee15caa6d618f32802c7271c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4fa05f10f9accc3c6c92a094b7814af50b69d88b46949bb2f939bc014a8b946e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e869607528a67f4a1a82750792972b9ee21d5225d480775d33f053cdfdbc62a5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 44a64f8918438ffde8e019dc445517cacb6085bf3d96af505cd3200ff9449d12
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 485bb73254b8006a43f85d41d5a1cbc99f12a36e06609bbabc42459546d9e55e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e3356eec965bd0c42d6fc29332919bad1aa513b1d2df87cffad6e8e1903fe45b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4944828a857fdecd52070a0bafd5d72ce1ab25bd87745cd3a08175ef9209d502
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4ebd9b14d7f17dd8a523a1f899de0f71a6e03aea91a998f2125d1af195f64a19
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 70f27a5b92fce9e0ca1ce2ee28cbf7a27e3cce0a64a9fb070f690bfa52b58dd5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ff36f562a5556879191b5ac3e6b31b5ff834f84a4760db8c22059bc14306324c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 15d8dedabb66c20fdc1e0d267b79f796eb74cb0b2bd5066b534b6fbdc3459543
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 52820bb68a97183dcb7b29368dc91e7047ae52192a8872535f4a023d155ddbf8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b69ef5e0d1240de710f7d370c0e53cb82c4c15450e40ee6e36493eb1c30b9d02
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 02d6c09432129fd9d7551d0a230c050e19ad011b3b6a502cea612b7ed8c39954
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4c9f54cba4676f50e978cd3552bc96911a4b81b3fb8f77207888ad3369637357
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 13ef7fac2573110c27bf92b4cea17bd1f103ab67ec76823773e38ccbc14dea69
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 16bf634e647cd9a90e9622702b5d76717bf2734a170797d19865be7401409e59
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 13270fa5a04e10ee5583aed2c02795af227cd5281d56ca07b7d227200ac4f0d4
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4ceb29bf7bc4a49efdea7955edabe761c26d1c7ff0edfa084e611f74964581d5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 83ad6e9c70f1e04c96f016bdb871397621edd837bb40bd20e4e92931bb3d43ba
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 12ec75de9a3bcbe7ca4f910adeed3ad2316224a5d08c341c62ef0e1effc84bfc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b5ccfe5d210ae15e3e8f8befcae010ab00dc4324848ca9420e40277d4a5b6545
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 341a54624bb7859ebbd81086394189ea24b74467e68f9257f60a62034c94a170
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 069e9af0b9761ccf4527caab9633d82b44dd3c5e7a62cf0c514063e3f3309962
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 252199942e1530793ab99538346628ef29447b41f04c566c42192cdf4bcfb89a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 475bdb9de5f25496d89cec3ae5f92085770daef8bf53adce113746c3c5ca039b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 e61407bd92ab4da338b4ade10b3689c58d32dba932320462a54df9d0d87e94c5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 75a5173c8eac0d488206e0f03fcdea7f59b157119325249dfad400cbdd8d1b92
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 20f9bca8fd916d09f27a4298488e884046a2e12cb4a4d2ad961b912684d990e2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d520b6cebe620ee9720137f1d82e3fbdac73ecdad685925dc3780aee8f1e9d9f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4e695acbcf4fce3bb5575fdb604b56093b7c273e897139af812e834596afd835
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6844b46ad3ef489f5436958a0b06b1c7af2f416870a856c541bd95af53cfe220
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 69e646951e43975e101f8b21f1da4208bf485d6dd5a33704ff8fd4c7aa0003fa
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 da379f623496d3bd92eb18a14b97ad2fa298a8c80cf9e8e30d8e260edd827d56
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ab853e10706c95fe2b021ac4a7e352f8dce1f17866a4258976ffdaa687f458bc
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2f38aaa9ddfa2d00959bd2b61983c12d3f71e390dce62c07961ae3f5e4e0876f
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d82dc0782391bf4e2f5f59e775cca0b510e0dbc286bc8cef22e83bd539d0b33b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 756d4ff7b65e19485d3124f352032e2f20cdb943f92003c595650feac7be048b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 bd1b60bd9f855899702be74a7e0e75e916a4c716b25015bf2d433ef81ed1b9a2
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 21da86575680d1567e625d18a6ec72d43cb6255a9b6f6d1582a86c6188738e81
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 b195ba046e33bb8e53f5e3f732b77f0e0a78b5e687c07340db42c2bec31652eb
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 00dd362375cb43c68d56b654cecc0b57b72dd7947c309de0c1f5442d03c5a4b6
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 57468e2990f59e08dbf5f2856f6bc1325bbaae6989b1562639f6ef1550b66874
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8a8797fd228580d2fa7f91b18a15dca331033154191c84a3ee447f72cf2c79a5
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c8efb5266dc64582f79f334da7101fac4695851e32a7031fe37b0733e9b1a93a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 458ca323d67d86d7009c71eba2fe2cf32e76bc74793b3f033d5685b0f1bd35ce
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 60b38c42fb2f7fce7881a94e9f5961178cec215757f9bb9c5018dda0979f7b1b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5b884843f80c2d52eb04399493f7d7952f3d4dd39e34fd660361e58d3dcc6a63
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f91d6a8a48f909a4d650c91d86c6b3965817e43e1a609f227b4168ea65940c6b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5b598759f871d7bcbbfec7e960cf37f8157486dbee71b65f38122c9a08238236
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 910ff97cced7117736e864e0c78cb28fa89260c259e2f83c47c85df404433b8d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 88f16cc18c0a276d4c7dafc1cd243d49feae74d08aac4cbeef2c2e6c20e1bfc9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fe9f4083a4b1c2229e16a0ecbf221db5e2080f87565655ca2ae321e0fe22bb84
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c131d6ea6b8a25d7318a3d482e56c148879bf6ba3cb7a0b469f58923400432d1
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 af6dc692dc2eb1f023719d3b97a68a9797a46f596430cf1bdc3472b79d5de008
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 73dcec04b9352b40ee634afa738c6181f0f158b60311aa0d0f1bc540ae03cb2a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c68a1fa648c0ccad941e466602362c64fb41c39b14f54a627a60a6c3ff809d3e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 20bc74ccc5de33ab69137c5046d94048eb1ab348e242c6ac720d43058143a783
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 70c78b66b768a48de1b73c250f5435520512d2d09ce2b91c6063bf9c3d8287a4
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 cdb0be8a7b9a87c11e9313c0018beae564b431dfd656257d14ff7a4b2be5d5eb
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d9d86657b44737c58380a804e44558139d330bcb6bb19f56365a7b44854a7986
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 4a0b8328ee28ed9b32cde7cdc7676a3c7f2a5e904f9673d26ce7e64204f08f11
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d48af90240e1fa62a2cc1886ca8b6bede249a91ad1e79cff868ae22cd6bf4df0
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f15b5c7ff0cdbf50f9286b0f9321c722cd1ef757cee3c31943eaa1b09a3f8878
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8f5e626d44d707fd15da498b64110042b7342551d2deb4de459e3ae8567e16d0
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 c6b683997955092520078cdabe24128043d43b9371e038335b16815789f1215b
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 5c257cf66510dce915e780baf30c7e0dcc7a7125320f1a6c80e4f84518e56b7d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 dde9f58c1deaa303563d971815f63c1d1b3b9fefb538f4dd965c9cb119312990
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 fb9f32c22d6d82a8145a2da8afd6c37fe2c573b006cb90684f7df7c6dec6a5b3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 ae88c91cf4a51909a4fa09aeca25701b45021ba694f4e2edb1029bfab243d11a
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 2d69110f8fa121ea01e75f7a8d02bbba41ae03556574a1b3aec1997f1120320e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 43e4c0c9dc8172a8a17cdde7577f24a420820e6ec8f3452b813a725e3223e8a8
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9f6f39f55a5cb3007a3e8e2fdf2398ffb71b13eeb998897dbec902da9539a484
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 f272c7ab3ea4cdf2c7bb65ebbecc75440530af3aec44248ec800b12acb55949e
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 a83220164477c07929d7dcf04487f2e659b84d1d70e23b3dfbd8316fc5fd29f6
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 8344590f8b558bd0c6467faf8d07262081ee4e2e47e438455d9df6b9426340e3
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 6c82206e15241ad2ba5ab61607d30a5347a3f54b6193f88b0b32309d77e79f9d
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 9038aa7d4de5980c57f6d14260b342c33d8f77cb8fdcf19d034d857c0124ffb9
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 d43d0e5111fdcb43ab2ca3362110e2058d6f17c644f39e56c4e9dbd183ce2c0c
            • MD5 SHA1 SHA512

            Admin7

            • Path C:\Users\Admin\AppData\Local\Temp\Admin7
            • Size 8B
            • SHA256 3222dc8b92ada616a45bda24d7dbe25b925cb34662abe5700e2ab760893a1b3b
            • MD5 SHA1 SHA512

            Admin8

            • Path C:\Users\Admin\AppData\Local\Temp\Admin8
            • Size 8B
            • SHA256 9f865732701f1f6847f54cd0fbd5dd94a53bb66e8f7121ff9903129a1d9de7e7
            • MD5 SHA1 SHA512

            USB.Exe

            • Path C:\Users\Admin\AppData\Local\Temp\USB.Exe
            • Size 536KB
            • SHA256 4c08d2f5e45249cb3dc582777455839e64eca5501681a4afca87ba9ab331f77a
            • MD5 SHA1 SHA512 SSDEEP

            Adminlog.dat

            • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            jusched.exe

            • Path C:\Windows\SysWOW64\install\jusched.exe
            • Size 1.1MB
            • SHA256 d964bc9f883fa390acd51b8d8a6104c4fe4ba3e3630d4ff1a4a59ffd52b15f2e
            • MD5 SHA1 SHA512 SSDEEP

            memory/1144-11-0x0000000000120000-0x00000000001AC000-memory.dmp

            memory/1144-13-0x0000000002610000-0x0000000002618000-memory.dmp

            memory/1144-12-0x0000000004CB0000-0x0000000004D4C000-memory.dmp

            memory/2524-157-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2524-158-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2524-173-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2524-166-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2524-159-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2524-165-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2604-86-0x0000000010410000-0x0000000010475000-memory.dmp

            memory/2604-85-0x0000000003500000-0x0000000003501000-memory.dmp

            memory/2604-26-0x0000000000440000-0x0000000000441000-memory.dmp

            memory/2604-27-0x0000000000500000-0x0000000000501000-memory.dmp

            memory/2852-22-0x0000000011350000-0x00000000113B5000-memory.dmp

            memory/2852-156-0x0000000000400000-0x000000000044F000-memory.dmp

            memory/2852-25-0x0000000010410000-0x0000000010475000-memory.dmp

            memory/2852-82-0x0000000010410000-0x0000000010475000-memory.dmp

            memory/2852-18-0x0000000000400000-0x000000000044F000-memory.dmp

            memory/2852-17-0x0000000000400000-0x000000000044F000-memory.dmp

            memory/2852-16-0x0000000000400000-0x000000000044F000-memory.dmp

            memory/2852-14-0x0000000000400000-0x000000000044F000-memory.dmp

            memory/2852-90-0x0000000010480000-0x00000000104E5000-memory.dmp

            memory/2852-93-0x00000000104F0000-0x0000000010555000-memory.dmp

            memory/2852-150-0x00000000104F0000-0x0000000010555000-memory.dmp