Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 01:52

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  • Size 687KB
  • Sample261014-cafs6set2s
  • SHA256 7b24dd561c1044e4778e773f142ab9f7757ef37a91524443bcda7b19990f392e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.5

Botnet
  • MIXERY

C2
  • soliver.no-ip.biz:3344

  • stahlgewitter.gotdns.org:3344

Mutex
  • seven88

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    uninstaller

  • install_file

    Defender.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    duke

  • regkey_hkcu

    WinHost

  • regkey_hklm

    Defenders

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:4392
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
          3⤵
            PID:1268
      • C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe
        C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5820
        • C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe
          "C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe"
          2⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Windows\explorer.exe
            explorer.exe
            3⤵
              PID:3320
            • C:\Windows\explorer.exe
              explorer.exe
              3⤵
                PID:924
              • C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe
                "C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe"
                3⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1784
              • C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe
                "C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe"
                3⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4020
                • C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe
                  "C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3436
                  • C:\Windows\explorer.exe
                    explorer.exe
                    5⤵
                      PID:476
                    • C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe
                      "C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe"
                      5⤵
                      • Executes dropped EXE
                      • Reads the TCP/IP host and domain name from the registry
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1712
                      • C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe
                        "C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe"
                        6⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1772
                        • C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe
                          "C:\Users\User\AppData\Local\Defender\uninstaller\Defender.exe"
                          7⤵
                            PID:5576

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Admin2.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
                    • Size 225KB
                    • SHA256 1a5f4c3aff15f40c46ad8e38afc68defcad1ddce358ab83ab74e41769ecc8aee
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    Admin2.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
                    • Size 225KB
                    • SHA256 1260e1ee5d48b4cd4141c8ee56b9440869a0789b45cac20060bd25493ed002a8
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 eae7abf86047e8e4f42bd6bdb6d12153c90504490bb89163b3f6154b2a13d8fb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 bbf66321646dc21a4193f4162b52099dd8a310a4b6506e5f842d2e8f84caeb61
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 657be4ca6ed166fe49997644c760012cee43df2c44e676f7b8a51d2feaa6d621
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2e90c01fc31f8a9db6c17bf1a5350bb63c7c7e5795828803d9c0f0e4b38a9163
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 01d2d65b34ac7e311e52bfb5384805fb9297fabd1756b56069e6c25957319897
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 71f1eddc4de3da044ec78c9bca1149006c9a54370ad4797cbf9db50dc0b46970
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2f7fad1f709bee96f1ce9cd6c57a50b013c4293350cfdc69be85f29cc31be859
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 55b1ef95c51aad236985d9ba7a42376cd96fab5559646641d20eda31f38d406e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 8fd7b1fc9ab794ba9d458010a36c2d00e3df537c8184fb885aea74768dee9e79
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 49af7257d1c2dfcf215678f482b155478797a6380d99f831fbdd6b1d55a6cf39
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 1710b07f83b41c234f0b02be7eac585e9921e43a2e2c3c59125e129f3cd2c96f
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 745fa96d9e8a765fde03bc3f379bcda11adae681c1b9ff9f5f220c76ee9d0889
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 877a5888636fc9179a5be89c7a490ffde4b305755ff2b63980bcbf9cb81f09e0
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d88632cd17a02f4f023d5cbdad67023ad738b77ced5c2848c6d66e411d3dd0b8
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 27bc457287b177073c8b3f694a6e902f9baac4d88ba99ea7034fd6ba40252906
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 7aab682ad3e1346dba80f1af84fb6cfc580da0867580eda98d9f5251ccbc72ba
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 eb3af4401dfdf57bf351041461b6d5c9f6f3adffccc2ab85e253355178545e28
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 3a0fffc1fcbc984dc792fdf74f5d7418327cc5a7bd1004fbee99f4b1f5f25c10
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 65d9c64b9a3aa04e773adf585ec4740475b9c7d5bc356f12c83dff64adecb6bf
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ea3a272f8f126fa1abf2fcddb79dfbc86819b1066fdd22e9340f7978c64121de
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 b117b3441744cca1524ccc3929ad99e53c12821721ad969327cfa6aee19bb3d1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ca74eaf3bcbd3117109d966fdbf8fb056f7fdbbde36dfd4205052f4b397a73a3
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 3d5e57df228e1fb14458ddcbf66c227e76446ee752432f5af7b4cc4226f09d91
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 5a911bf0b43411700fd19123dc8bc04d8314cbbe1173856c11148fb1ee5d91b9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 89b24062359f3304480091d13ac7a4dc588c68e20937762b103d1474079783c4
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 0dc3e721f4d84871a7a3bee5e50105f723f74dde6c053686303958a4048f4356
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ff8a1ed8d88e74a78c2fe5c925bb7d57c9e5defdd378a865edeeecdc63bd17a8
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 b3fad8e7956d3f96c6485737bd101ee8f476609afe0ff466cc98122714cd2063
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a7f2e16238bd687592e9f2c292ccb3d47b4b5362bf3ce6f8590935cc475a0fd9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2407027d99c0ad8eeaf81578514a4a3599fea371b794bd4d4825801f9d00a0a8
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 383c05b039a931fbf062d100c68b8e6cc300a0ecba159e15d515615af1c02c8e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 46d964484f710a1b73d1cc03617b100bc7cbcccce22b7797da99d2f9e219a7f0
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 110369ab6d2eb1f79061cac2e6079f7ef296295e7882c393b8761c5e3d4e1f7f
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 29e8aace94ed0bc35c020271828a1d6938577a9274b2594e317f017e566a9bfa
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 15cdc7bbd24e1886e001b4438c32d9031f8288ebb6f6294c2e5d9846223accff
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 9feefebd7b40d64bdc199583b8245abbbc10e1b2047a4e600059e57aa2ea6cdc
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d6fc9feab7fff820634d394447bba56990a7bf666a2afc380247b0b05c8a7910
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 73287f1e3a6b6bab6aaf444150ec2ff7c5cfeea4705b39c33981bf93d96f4c64
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 699e2c9bcfc230cf12105b183db22308bf2ec30a36a9ad97e3299fb1fab894ac
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ac93312cf2758aace8e1b026c91f06a621eac712297103a184277ecc573e0f1d
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 c2b0ec9ab4b3da8594f70a4c3126b386902b62b4dd116b94b583943fcf2a69fc
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 00bf68fe2907392ac519132397a5ce8550b5c115f000e2a74b55174c4c272289
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a1b52406182c97b0bca78af62da83250fc67d13bd8711d2b3a8ed449ef8c9d53
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a627040ea36e6ee4ac6a8006d5ed043e1965c9d90021b37a0fdf0f4485988d4e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 86b6297b050590ba3e171e24e9c36239dda9d4a85c442ac6eb21d40c76757455
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 1a625f692eaf0388c3a2d7bb035419b8463cb0c2272f537f37b06197fc5fcbd8
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 60f20a668baea41a2240dc344daa4a3216fc87bf8b40808357251f63363509d1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 6ac94207fee92a574e1396826e357297f69f7a70a92049632a51e8474ba388c5
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a9d2414f066e971fc668f29b11cf1d3ca21f3cbfbecc40fe80cacf6dc46dc455
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 e54767caa667246eefc31016cbd55a9128de84f33a403487d90f7051764cc2c0
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 0c8dbffb9b097ee5972698f5586f3df04cf8c4c2bdb60de297607ba4b847dc16
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 43a39726d2f10838f0ff6662ad554b541617d16041ddffbebd38a47402c0f7b9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a3ba0630b2c0bf3dd956722bc5e1a00b4fb50815c830814096c32638e2452a9f
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 685ac4a1f2941c4fd6a23259e056bf527dfb0f040e6e87798a3e231956714ceb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 cf77c4c69694c50e00a75da09b2c646362835c9aaecdef5ffeeaf22ea09dcbf4
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 5f991c5c827a743fd091c356628a968872e3a683ef4b618fcbf87204e6e1ad44
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 64315689b358beb401ec5d666d22c22afa89a2e2aeb5c23ac49cf0d83dd1a90e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ff5bee6ac786399962c4d958c1ab32258d77138410a0ef5295a967bffc39a027
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 9a31c015a40d3be15f1a2d695eb8aae3c3753e467baef4d132757e0b185bfab1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 42a387050fa3e8e633b1965175392e5d5d520bbc99bacc0f6c995d9313d06ebb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2d564d6c09c88b637f5c997c1b547967ae6cb2382daa53b0501555a0398d1746
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 e4b96af032ae8076b62ba4e08fef041c06787ea4caf85ecd58963695daecdaea
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 4251dd130a77ac58649e9298a618d3b8483a18419aed2e2c69c5f54ad2b1ae5e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 59c893d59ecc9324ef2647e79a2160fef5d7188df0be56e2d8d9aa2db627b58b
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 931bfdf9633b8a2104d1118e8c48f6412c9ea420c32d4cc20809b2ecf6373b01
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 6231e9093c559ff8b8ab8e99d282e950b78847fa18b3b1a561c0aa9b4b1e6ec1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d76dfe5f83e920d46893fe0d11b8ca2c90daa0150d87a9935abecc46511d6bc1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 8803685e273c7f565a407d302632ac2c76917418d44338ce23bda985941e6c8c
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 7c771b0b24b5ed28357bda3ed913040e29412d4dd46c0ec4b20059ecc7d7f113
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 3c8516c66cb86e9606ecd7beab3ba6ae0f9965dedc237b8be900bcbf7a5ffe60
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d594bb932e335393d72e4d38cef0faa28da131d58afc81928d973522e721eb17
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 df1c0c9755a9d51ed1a872e16a3183dabadc892b8e40f31434bd90f7cb4625f9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 34d78687f51084dfef60b24fa6340f9dd7733e5b1b9cd89457d3968063507906
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 1fb3905782ce975465b636684ecd5bb945cdc5ed8e2360b7b43a7729e3e4ba2d
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 7a28f02af4fb25f290154da203b598020de8d97a6fb2fc874bbd0a0801216c9a
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d3e37a40dcf244c81df42dfe70a131f745af33a4b305520f1b293eee1269bc15
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 57ba59935278b83bfadb19d51cd8db24aca4464b29d33604cce341b6398e1abd
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 dd101c765212ca3b59c0271cc9c5956286752be2bd600ce79307e2426a9e1a2f
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 537dc37dce9d4e642412190d68abdc2352c5328c313877f4eca6ed6620aa6f08
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 aa89d990544ae90152462688caa83f15933b802b1300af9eb92c076ebdfaf77b
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 7207f26c225515143abf7b90f293072fcac710cb85ed29afcd0ec6237a1d7521
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 4a190aa0ab0b8847871b77d4724c5e8d03624bf843ce3c9a3000a71a350b3278
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 150712a84d486938f28de406d83148be946c736c3e0b5e60b53076d954d59814
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 e03e9e87c747b8bf6e50bef0bcc44ec0fe5b24ca6933b611c8a4351393bb915c
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2e19ada452ee23276bbbbd1dcc1dcbefe04c8be4319a7109dfe65b88f4363f2d
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 333cf46ce6b3f3c9058439f15666f12c23648a9cace8dc921532a48cde608267
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 57cc801cc49e8f90fb256c08a7d309fa65fbc74a87d68b4f5f95dd3d7f71292e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 c6cb593f151bd29d349360e4ac78ac0d060a1f9863b93c1a961cac37edf1eb5b
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 8b172aea5784ffaadaa9cc8655a209e0deda6cb63966601a1027a5fafe0fe44b
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 91a50e2e596a1901c9164224a3a0a98806b9d70f18cdf3c3302177683c4f2810
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 8d7dc8b5255e8841102c47e4a7822c5d1b634387b98c54cbf101e808f1a81757
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 49480564bd2f89705c5c927618c84676de6a988dcfcb8b28e4e9bbce2fe4df11
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 b5baaf2a83d1ce88cc26405af5e48151b4330ea2510120cf07545a068a6156f5
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a7b7d9619c60677473e017f4d1dc06aa4493811c7cefd9ca2f16014f6b417687
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d8afb8c7168af665ee20db10497594fad5fc9ccf77888655dfb34fc7dfae7e48
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 9ba9a9b26e48d3d512b17c8774151f36603ad700ce3219959f34731338f9d11e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 c79841859f69e34d8562eb7334a2708e53f0aca8ac7ef0817523d7b1941cca52
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 3140eca0ad16f0d80dcbd5be76a03950567c570e211dce9a95d6dada9d93b824
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 6b343e58168c0c2240877becc8bcbd8eb30c6140aab6d1096b2afc90b6c189d3
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 97ef4479de5ea87f774e1c7730c7aff2f89c7e2ab35121959730345d487dceaa
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 8a7e7408958245868a362c784d8cfa8f6d6595f321ed0c1a98b2aac2121c6a9e
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d8ce60f826e32f1ddafa9977bb3873f2e08f2c08c2f8b71c1bdbf14f4af1ccc9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 9e6f4fc91b8e1d575de49fd282d07da6cb7de039d6a4618e9a821b16065fa602
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 5011939e91da84109c4507e8f17441817384eb10679f8d49cd191762bdb93e1a
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2b5fcdf8ed3588565a227864b6bb168aa355962f7be305803f41367784837752
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 93d5c0ee42b51d2e85b9bbf42fca749761daf547700e384e1c56d82e314c7b87
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 9c9c1d76c9252c0ffe1d1b0f8475ab009a8c4b1ea321443733ce45bb17adf455
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 42d3ca290c95f6b192a7e5be0832ce0c74a2a52cfc74fea852bc64336774a32c
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 1e7563dfd8d94a47660fe75c67b7cd0150d91ff689b4d35fa172a8ecc03fccfb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 2d82237bf6775cd799cee291caf557e05bf8657e77ff15ab269c63f70d055911
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 ecaa42af2c9940786c35abb7705d227a2e0135366feaefa4e55397bf224ea7a1
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 4717a2137d5154aa82d3b15c1453b24bdffc9730ed8ad68de7b791fd55a52848
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 f8e2b77e8bcb63d6ff414535311b67295052eddafc80fefbf92a1bf5af191dfb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 e45b980624da0b1fba6f62b1ae1281f967e90e32758e21cf0aeeb8e152c25636
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 98291a06474fd3247c2f9dbb613bcac239926535dcdbd07b6cbddd1890f2f67a
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 c0d6d8b265a0426ede3ee4e254ecbc0253218b020b5bae46d225763714ad0065
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 4b169404f62cb13e764d128abd6a5110bc17c3e94c490a23c3795f98922bc6ab
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 5e2a9f7588955485c59bb71248808173df34a8aea5787c6718bc2e1c0e97f424
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 b4cc374767a04b17f98d585f53d0735743d2441faf8b7e4f7009f9a539461361
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 981212030d88c5c0ebf411455e7cb313f2e50656e3a1b8c115303b1daec98ebf
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 044eebae610e3c14965ddc9e8d7bc06cfda801cdcdab1d756c93a78282a378b0
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 faa62e9e0af79b351c441cd21bfa713c18ed652d9a16f03dcd04f0aba24fd7ea
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 86678d12a142f74256463ab00e4f6cdf203af0555eb3ce15468484aee2a46ceb
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 77977cc2a5bbd5c114a11e96f4afb352906b02212e7d7b93f16c424b5de43f4c
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 a440797b26071c159dc30ab4f4ad338f5d858e26e9d4a42564d80dcf995c57d0
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 17632c316ae818bb881b512a8128c79adb928d37c255119cde89d17e5bec66f2
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d1edb59f388d1df26b194a6bc25252b994b15f42c90c689443b67b7b241a2941
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 d9198fc034d743cf4768a82d840f7f47364ae29828a003161cf7506621d770ca
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 38c8cd40c71e078688caf78d9c85f579736ae0a81bcd1d0618d752ad28e04826
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 53e386a345d8e828691c6472fdcbef472960870461ca50728d64b9ce12cb1a90
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 0b79b232ca5f8aeda937603505e417bbb2d87d1937d3e4f3fd5a45bb1a2613e9
                    • MD5 SHA1 SHA512

                    Admin7

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin7
                    • Size 8B
                    • SHA256 f8e546dc173d5b742544d2bd3d6079a40ff44f65f76b78adc94dcb9cae5a9609
                    • MD5 SHA1 SHA512

                    Admin8

                    • Path C:\Users\Admin\AppData\Local\Temp\Admin8
                    • Size 8B
                    • SHA256 85258463ed6e2331ac1661ed8167f87326524a1ca94f16c0b0851564ee94b43e
                    • MD5 SHA1 SHA512

                    TJNvWWoEJYzh.exe

                    • Path C:\Users\Admin\AppData\Roaming\TJNvWWoEJYzh.exe
                    • Size 687KB
                    • SHA256 7b24dd561c1044e4778e773f142ab9f7757ef37a91524443bcda7b19990f392e
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    memory/1712-172-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1712-170-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1712-168-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1712-174-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1712-171-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1712-179-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/1784-93-0x00000000104F0000-0x0000000010555000-memory.dmp

                    memory/1784-92-0x0000000004910000-0x0000000004911000-memory.dmp

                    memory/1784-33-0x00000000010A0000-0x00000000010A1000-memory.dmp

                    memory/1784-32-0x0000000000F20000-0x0000000000F21000-memory.dmp

                    memory/2956-23-0x0000000010410000-0x0000000010475000-memory.dmp

                    memory/2956-19-0x0000000010BA0000-0x0000000010C05000-memory.dmp

                    memory/2956-16-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/2956-11-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/2956-15-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/2956-96-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/2956-89-0x00000000104F0000-0x0000000010555000-memory.dmp

                    memory/2956-27-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/2956-31-0x00000000104F0000-0x0000000010555000-memory.dmp

                    memory/2956-24-0x0000000010410000-0x0000000010475000-memory.dmp

                    memory/2956-14-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/3392-0-0x00000000017F0000-0x0000000001800000-memory.dmp

                    memory/3392-1-0x0000000075142000-0x0000000075144000-memory.dmp

                    memory/3392-2-0x0000000075140000-0x0000000075761000-memory.dmp

                    memory/3392-5-0x0000000075140000-0x0000000075761000-memory.dmp

                    memory/3436-106-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/3436-99-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/3436-100-0x0000000000400000-0x0000000000458000-memory.dmp

                    memory/3436-164-0x0000000010480000-0x00000000104E5000-memory.dmp

                    memory/5820-10-0x0000000075140000-0x0000000075761000-memory.dmp

                    memory/5820-17-0x0000000075140000-0x0000000075761000-memory.dmp

                    memory/5820-9-0x0000000075140000-0x0000000075761000-memory.dmp

                    memory/5820-8-0x0000000075140000-0x0000000075761000-memory.dmp