Malware Analysis Report

2025-08-10 17:47

Sample ID 221021-hfeqysfhhp
Target cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
Tags
cybergate light persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68

Threat Level: Known bad

The file cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68 was found to be: Known bad.

Malicious Activity Summary

cybergate light persistence stealer trojan upx

CyberGate, Rebhip

UPX packed file

Adds policy Run key to start application

Executes dropped EXE

Modifies Installed Components in the registry

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-21 06:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-21 06:40

Reported

2022-10-21 15:24

Platform

win7-20220812-en

Max time kernel

152s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{VX24I44T-IXGA-2P5A-2L1U-01M8855044L2} C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{VX24I44T-IXGA-2P5A-2L1U-01M8855044L2}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\audiadg.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1760 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 1760 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 1760 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 1760 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 1324 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 1324 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 1324 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 1324 wrote to memory of 768 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1616 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe

"C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe"

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

"C:\Users\Admin\AppData\Local\Temp\bcdprov.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 l1ght.no-ip.org udp
CA 158.69.4.21:82 l1ght.no-ip.org tcp
CA 158.69.4.21:82 l1ght.no-ip.org tcp

Files

memory/1760-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

memory/1760-55-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/1760-56-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/1616-57-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-58-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-60-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-61-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-62-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-63-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-64-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-66-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-67-0x000000000040E1A8-mapping.dmp

memory/1616-68-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1616-70-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1324-74-0x0000000000000000-mapping.dmp

memory/1616-78-0x0000000000400000-0x000000000044F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

memory/1616-75-0x0000000000400000-0x000000000044F000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

MD5 55ef9dab56221dc72b4d6406f756e2ab
SHA1 7a535f948980df42bca05ee2d6ada088aa151dd2
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA512 75a95e3bda4fa067f42d4e96225958c2a08e3f76633b1df026127c1b88abec4b992a07aecdd14c0017b6f77eb5b06199fec1d3eacd695ed3f7e9694555402521

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

MD5 55ef9dab56221dc72b4d6406f756e2ab
SHA1 7a535f948980df42bca05ee2d6ada088aa151dd2
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA512 75a95e3bda4fa067f42d4e96225958c2a08e3f76633b1df026127c1b88abec4b992a07aecdd14c0017b6f77eb5b06199fec1d3eacd695ed3f7e9694555402521

memory/768-83-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\bcdprov.exe

MD5 55ef9dab56221dc72b4d6406f756e2ab
SHA1 7a535f948980df42bca05ee2d6ada088aa151dd2
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA512 75a95e3bda4fa067f42d4e96225958c2a08e3f76633b1df026127c1b88abec4b992a07aecdd14c0017b6f77eb5b06199fec1d3eacd695ed3f7e9694555402521

memory/1616-86-0x0000000000401000-0x000000000040F000-memory.dmp

memory/1324-87-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/768-88-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/972-90-0x0000000000000000-mapping.dmp

memory/972-95-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1616-92-0x0000000010410000-0x0000000010475000-memory.dmp

memory/972-97-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 24d14743f72fe40babbb20a22afe12e7
SHA1 7c22498a522dc954d746882fc214b703ed6e7d6f
SHA256 383b9f1ec304eaf54d8cc9fb7a211641ce4f7d325aad55d72b6b48385f1fcc93
SHA512 4921d74d93454b5046016fb51c0847afc1cf98ef20cd9b491e41422a35540a0209b3ff455d1fb144b7f8defb9011fb6fef6ebbfb8152b781250ce784fefff975

C:\Windows\SysWOW64\install\server.exe

MD5 0f01571a3e4c71eb4313175aae86488e
SHA1 2ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA256 8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512 159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

\Windows\SysWOW64\install\server.exe

MD5 0f01571a3e4c71eb4313175aae86488e
SHA1 2ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA256 8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512 159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

memory/1988-101-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\install\server.exe

MD5 0f01571a3e4c71eb4313175aae86488e
SHA1 2ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA256 8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512 159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

memory/972-104-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1324-105-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/768-106-0x00000000741F0000-0x000000007479B000-memory.dmp

memory/972-107-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1736-118-0x000000000040E1A8-mapping.dmp

memory/1736-121-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1736-123-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1736-125-0x0000000000400000-0x000000000044F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-21 06:40

Reported

2022-10-21 15:24

Platform

win10v2004-20220812-en

Max time kernel

158s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{VX24I44T-IXGA-2P5A-2L1U-01M8855044L2} C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VX24I44T-IXGA-2P5A-2L1U-01M8855044L2}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\audiadg.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3292 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4764 wrote to memory of 788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe

"C:\Users\Admin\AppData\Local\Temp\cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

"C:\Users\Admin\AppData\Local\Temp\bcdprov.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
NL 20.123.141.233:443 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
IE 13.69.239.73:443 tcp
US 8.8.8.8:53 l1ght.no-ip.org udp
CA 158.69.4.21:82 l1ght.no-ip.org tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
CA 158.69.4.21:82 l1ght.no-ip.org tcp
CA 158.69.4.21:82 l1ght.no-ip.org tcp
US 8.8.8.8:53 l1ght.no-ip.org udp
CA 158.69.4.21:82 l1ght.no-ip.org tcp

Files

memory/3292-132-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/3292-133-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/4764-134-0x0000000000000000-mapping.dmp

memory/4764-135-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4764-136-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4764-137-0x0000000000400000-0x000000000044F000-memory.dmp

memory/788-139-0x0000000000000000-mapping.dmp

memory/4764-140-0x0000000010410000-0x0000000010475000-memory.dmp

memory/788-143-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 24d14743f72fe40babbb20a22afe12e7
SHA1 7c22498a522dc954d746882fc214b703ed6e7d6f
SHA256 383b9f1ec304eaf54d8cc9fb7a211641ce4f7d325aad55d72b6b48385f1fcc93
SHA512 4921d74d93454b5046016fb51c0847afc1cf98ef20cd9b491e41422a35540a0209b3ff455d1fb144b7f8defb9011fb6fef6ebbfb8152b781250ce784fefff975

memory/788-145-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Windows\SysWOW64\install\server.exe

MD5 454501a66ad6e85175a6757573d79f8b
SHA1 8ca96c61f26a640a5b1b1152d055260b9d43e308
SHA256 7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA512 9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

memory/2452-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 ea196209244297c543ec542109c9a9b9
SHA1 48a843f194b89c8ccd547ea4ab7e1a24898c6cd9
SHA256 644e2a74e866baaffe2cf3ac6107547769ff77614b5ffeacb64245b114d9870b
SHA512 6e38603ce3718f85c29417aa232a22323a121155bd69599b2587e7b68214ecbd4138f2ab748083e44534abc4ae8a0fdc5cfa451332a36fca9fbf8acdc6fef2d2

C:\Windows\SysWOW64\install\server.exe

MD5 454501a66ad6e85175a6757573d79f8b
SHA1 8ca96c61f26a640a5b1b1152d055260b9d43e308
SHA256 7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA512 9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

memory/3480-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

MD5 55ef9dab56221dc72b4d6406f756e2ab
SHA1 7a535f948980df42bca05ee2d6ada088aa151dd2
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA512 75a95e3bda4fa067f42d4e96225958c2a08e3f76633b1df026127c1b88abec4b992a07aecdd14c0017b6f77eb5b06199fec1d3eacd695ed3f7e9694555402521

memory/1640-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

MD5 55ef9dab56221dc72b4d6406f756e2ab
SHA1 7a535f948980df42bca05ee2d6ada088aa151dd2
SHA256 cd6b6eaa5001a7dbdaaa542466c801dab48073fd5eee469b9a8a5ffe6da5ac68
SHA512 75a95e3bda4fa067f42d4e96225958c2a08e3f76633b1df026127c1b88abec4b992a07aecdd14c0017b6f77eb5b06199fec1d3eacd695ed3f7e9694555402521

memory/2452-155-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/1640-156-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/788-157-0x0000000010410000-0x0000000010475000-memory.dmp

memory/2452-158-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/1640-159-0x0000000074A30000-0x0000000074FE1000-memory.dmp

memory/4800-160-0x0000000000000000-mapping.dmp

memory/4800-163-0x0000000000400000-0x000000000044F000-memory.dmp