cybergate | 53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19

Analysis

max time kernel
174s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Size

364KB
MD5

63ae9f85778168aa4cd2fa53e4a37580
SHA1

d1676765366550fd3d76f52c4afc3d0e9c7a8866
SHA256

53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19
SHA512

69b719333954d83cd0550eda162c27484a24155a2a486f395542159a04b9206220270bad3ec15a0470a96aa6e532e23affde985365372e3128089ee9aad4182a
SSDEEP

6144:jM5rH0B9gIdPQAjNTrR47RwhwR4uiLZJzsZ7jpNaoQqd5uzkk4:XX3jNTtYRyZnLXKQqWzkk

Score

10^/10

cybergate bbva persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

BBVA

127.0.0.1:80

rigodon.no-ip.info:80

Mutex

ASD7669AF

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
winlogon.exe
install_dir
microsoft
install_file
Winlog.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Archivo incompatible
message_box_title
Error
password
abcd1234
regkey_hkcu
user
regkey_hklm
machine

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\microsoft\\Winlog.exe"	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\microsoft\\Winlog.exe"	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Executes dropped EXE 2 IoCs

pid	Process
5076	Winlog.exe
2080	Winlog.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{034C26E7-3R76-64S2-R0KS-HJKW147O5SG4}	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{034C26E7-3R76-64S2-R0KS-HJKW147O5SG4}\StubPath = "C:\\Windows\\microsoft\\Winlog.exe Restart"	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-136-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4852-138-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4852-140-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4852-141-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4852-143-0x00000000006F0000-0x0000000000752000-memory.dmp	upx
behavioral2/memory/4852-148-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4656-151-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4852-152-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4656-154-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2080-167-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2080-168-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2080-169-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2080-170-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4656-171-0x0000000024010000-0x0000000024072000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\machine = "C:\\Windows\\microsoft\\Winlog.exe"	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\user = "C:\\Windows\\microsoft\\Winlog.exe"	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 5076 set thread context of 2080	5076	Winlog.exe	84

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\microsoft\Winlog.exe	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
File opened for modification	C:\Windows\microsoft\Winlog.exe	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
File opened for modification	C:\Windows\microsoft\	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
File created	C:\Windows\microsoft\Winlog.exe	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
2080	Winlog.exe
2080	Winlog.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4656	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
Token: SeDebugPrivilege	4656	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
5076	Winlog.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 3252 wrote to memory of 4852	3252	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	81
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82
PID 4852 wrote to memory of 4656	4852	53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe	82

C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
"C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
  "C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe
    "C:\Users\Admin\AppData\Local\Temp\53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
  - - C:\Windows\microsoft\Winlog.exe
      "C:\Windows\microsoft\Winlog.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5076
    - - C:\Windows\microsoft\Winlog.exe
        
        "C:\Windows\microsoft\Winlog.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
a84d7255ee8bfbf5789c1975cfad3d64

SHA1
eac8312b94dbb7184b232c3af7b1099b95d31fa1

SHA256
6d3474fa4052b3e8c7ba6ef690525c1127c183a7210e34fbbdd29c0c9a7944d8

SHA512
b1d186507a9cb19356bcdd5f1b98ccd8436a4d28aba54e1f68956b10ef2579bd23d155f6ef27c0eed0981b6fb7655ae5c0ed7cd50ac8c390d137d4a944c81998

Download Submit
C:\Windows\microsoft\Winlog.exe

Filesize
364KB

MD5
63ae9f85778168aa4cd2fa53e4a37580

SHA1
d1676765366550fd3d76f52c4afc3d0e9c7a8866

SHA256
53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19

SHA512
69b719333954d83cd0550eda162c27484a24155a2a486f395542159a04b9206220270bad3ec15a0470a96aa6e532e23affde985365372e3128089ee9aad4182a

Download Submit
C:\Windows\microsoft\Winlog.exe

Filesize
364KB

MD5
63ae9f85778168aa4cd2fa53e4a37580

SHA1
d1676765366550fd3d76f52c4afc3d0e9c7a8866

SHA256
53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19

SHA512
69b719333954d83cd0550eda162c27484a24155a2a486f395542159a04b9206220270bad3ec15a0470a96aa6e532e23affde985365372e3128089ee9aad4182a

Download Submit
C:\Windows\microsoft\Winlog.exe

Filesize
364KB

MD5
63ae9f85778168aa4cd2fa53e4a37580

SHA1
d1676765366550fd3d76f52c4afc3d0e9c7a8866

SHA256
53d493cb1d89b755d39c6f4b2315e3a10fb38ad69abc2108429fdd59eb708b19

SHA512
69b719333954d83cd0550eda162c27484a24155a2a486f395542159a04b9206220270bad3ec15a0470a96aa6e532e23affde985365372e3128089ee9aad4182a

Download Submit
memory/2080-170-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2080-169-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2080-168-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2080-167-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3252-139-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3252-133-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4656-153-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4656-154-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4656-151-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4656-171-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4852-141-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4852-152-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4852-148-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4852-143-0x00000000006F0000-0x0000000000752000-memory.dmp

Filesize
392KB

Download
memory/4852-140-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4852-138-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4852-136-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5076-161-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5076-165-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download