cybergate | bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a

Analysis

max time kernel
157s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe
Size

613KB
MD5

01f796e012b4eb1e558618de023d4e20
SHA1

ba494c7fb58e3762bd49e4e21c200f71cf330735
SHA256

bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a
SHA512

58ec3d910309d35d19b47863d3d2f2567dd037a470f2527768080a8b7467e6294516b461715eb6d728e5e3b53527dedda568ec434b6c1c26d036ca1eaedd37a4
SSDEEP

12288:MQXy90YiNitwFR5VC8rPYlDSSYVyTU3Gnq0l7nLaZ/XXi56:MQXy+N9R5VxrP+kVyTGGnq0ZLs/HJ

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victima

192.168.0.11:2000

212.198.55.2:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
speed
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Heart.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Heart.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\speed\\server.exe"	Heart.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Heart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\speed\\server.exe"	Heart.exe

Executes dropped EXE 8 IoCs

Processes:

Heart.exeHeart.exeHABBOS~1.EXEHeart.exeserver.exeserver.exeserver.exeserver.exe

pid process

4496 Heart.exe
3932 Heart.exe
1236 HABBOS~1.EXE
3032 Heart.exe
4576 server.exe
996 server.exe
2520 server.exe
4192 server.exe

pid	process
4496	Heart.exe
3932	Heart.exe
1236	HABBOS~1.EXE
3032	Heart.exe
4576	server.exe
996	server.exe
2520	server.exe
4192	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exeHeart.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\speed\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	Heart.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\speed\\server.exe Restart"	Heart.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3932-146-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3932-150-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3932-151-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3932-157-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3932-161-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3932-168-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4800-171-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4800-174-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3932-175-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3932-177-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/3932-183-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3032-186-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3932-187-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3032-200-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2520-212-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/2520-218-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/4192-226-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/2520-227-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/3032-228-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Heart.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Heart.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Heart.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exeHeart.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Heart.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\speed\\server.exe"	Heart.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	Heart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\speed\\server.exe"	Heart.exe

Drops file in System32 directory 6 IoCs

Processes:

Heart.exeHeart.exeserver.exeserver.exe

description	ioc	process
File created	C:\Windows\SysWOW64\speed\server.exe	Heart.exe
File opened for modification	C:\Windows\SysWOW64\speed\server.exe	Heart.exe
File opened for modification	C:\Windows\SysWOW64\speed\server.exe	Heart.exe
File opened for modification	C:\Windows\SysWOW64\speed\	Heart.exe
File opened for modification	C:\Windows\SysWOW64\speed\server.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\speed\server.exe	server.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Heart.exeserver.exeserver.exe

description	pid	process	target process
PID 4496 set thread context of 3932	4496	Heart.exe	Heart.exe
PID 4576 set thread context of 2520	4576	server.exe	server.exe
PID 996 set thread context of 4192	996	server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4368 2520 WerFault.exe server.exe
428 4192 WerFault.exe server.exe
Modifies registry class 1 IoCs

Processes:

Heart.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Heart.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Heart.exe

pid process

3932 Heart.exe
3932 Heart.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Heart.exe

pid process

3032 Heart.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Heart.exe

description pid process

Token: SeDebugPrivilege 3032 Heart.exe
Token: SeDebugPrivilege 3032 Heart.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Heart.exe

pid process

3932 Heart.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Heart.exeserver.exeserver.exe

pid process

4496 Heart.exe
4576 server.exe
996 server.exe

pid	pid_target	process	target process
4368	2520	WerFault.exe	server.exe
428	4192	WerFault.exe	server.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Heart.exe

pid	process
3932	Heart.exe
3932	Heart.exe

pid	process
3032	Heart.exe

description	pid	process
Token: SeDebugPrivilege	3032	Heart.exe
Token: SeDebugPrivilege	3032	Heart.exe

pid	process
3932	Heart.exe

pid	process
4496	Heart.exe
4576	server.exe
996	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exeHeart.exeHeart.exe

description	pid	process	target process
PID 2116 wrote to memory of 4496	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	Heart.exe
PID 2116 wrote to memory of 4496	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	Heart.exe
PID 2116 wrote to memory of 4496	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 4496 wrote to memory of 3932	4496	Heart.exe	Heart.exe
PID 2116 wrote to memory of 1236	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	HABBOS~1.EXE
PID 2116 wrote to memory of 1236	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	HABBOS~1.EXE
PID 2116 wrote to memory of 1236	2116	bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe	HABBOS~1.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE
PID 3932 wrote to memory of 2616	3932	Heart.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe
"C:\Users\Admin\AppData\Local\Temp\bf427b56169ec00dca1063e9018a27928dd7bda540802467dc4a0286ea9b919a.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies Installed Components in the registry
PID:4800

C:\Windows\SysWOW64\speed\server.exe
"C:\Windows\system32\speed\server.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Windows\SysWOW64\speed\server.exe
"C:\Windows\SysWOW64\speed\server.exe"
7⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 576
8⤵
- Program crash
PID:4368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:2304

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SysWOW64\speed\server.exe
"C:\Windows\system32\speed\server.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\SysWOW64\speed\server.exe
"C:\Windows\SysWOW64\speed\server.exe"
7⤵
- Executes dropped EXE
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 532
8⤵
- Program crash
PID:428

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HABBOS~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HABBOS~1.EXE
3⤵
- Executes dropped EXE
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2520 -ip 2520
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4192 -ip 4192
1⤵
PID:4480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HABBOS~1.EXE
Filesize
774KB

MD5
a51160ab62a801c57b4883163ec5762d

SHA1
9cd7dff0337a450f9e8879c3cf4ce20895360bb0

SHA256
36e0a3532af0e46a393f40718a2dd40f26d684be1388597c6a8a59a7567a539e

SHA512
1d74da356a5255f66981287fe3a252f607cdee03ee1b9d39aef01a8fd80eb7bb3c0ba28cc31fd6e38706a7eee77853e9ab80c79628e5d8a55f956d7a91140766

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HABBOS~1.EXE
Filesize
774KB

MD5
a51160ab62a801c57b4883163ec5762d

SHA1
9cd7dff0337a450f9e8879c3cf4ce20895360bb0

SHA256
36e0a3532af0e46a393f40718a2dd40f26d684be1388597c6a8a59a7567a539e

SHA512
1d74da356a5255f66981287fe3a252f607cdee03ee1b9d39aef01a8fd80eb7bb3c0ba28cc31fd6e38706a7eee77853e9ab80c79628e5d8a55f956d7a91140766

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Heart.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
a22f57b73184a59d38a0eb5bddd4886a

SHA1
04eb5d90a513853213ebc1d1089bb46c1a303f5e

SHA256
19ec9c1d7f145b229538783ce4054175fe0e088b4c2713ec0d6a4fdc5667b0a2

SHA512
e06db4325778759b2bb6bc1017d474e1ab72261d0eedd9629e645d6a413b6e74a0d8f54eb930af62fbad52e19a07715e3a867b5157dbde6687c0778e17779129

Download Submit
C:\Windows\SysWOW64\speed\server.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Windows\SysWOW64\speed\server.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Windows\SysWOW64\speed\server.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Windows\SysWOW64\speed\server.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
C:\Windows\SysWOW64\speed\server.exe
Filesize
378KB

MD5
e3b9e4270e8e573533bec521547b72e3

SHA1
71716aed99b4b322042aaa59480e7057a66f7865

SHA256
8cd410b0b5b4fedf823747af91e56bb42703ba16390269775e8e5dcbbe051e90

SHA512
14970e4cb30986047352560a0144485552e5468220eb971b965fefe02b22d7d39768f3cf19e910fcfd46c0dcd03da0adc5665a76fc29237ad166ffa6974579ca

Download Submit
memory/996-214-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/996-204-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/996-207-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/996-203-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/996-211-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/996-201-0x0000000000000000-mapping.dmp

Download
memory/996-210-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/996-217-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/996-216-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/996-215-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/996-223-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1236-152-0x0000000000000000-mapping.dmp

Download
memory/1236-156-0x0000000004B00000-0x0000000004B9C000-memory.dmp

Filesize
624KB

Download
memory/1236-158-0x0000000005160000-0x0000000005704000-memory.dmp

Filesize
5.6MB

Download
memory/1236-159-0x0000000004BB0000-0x0000000004C42000-memory.dmp

Filesize
584KB

Download
memory/1236-155-0x0000000000080000-0x0000000000148000-memory.dmp

Filesize
800KB

Download
memory/1236-164-0x0000000004C50000-0x0000000004C5A000-memory.dmp

Filesize
40KB

Download
memory/1236-165-0x0000000004CC0000-0x0000000004D16000-memory.dmp

Filesize
344KB

Download
memory/2520-205-0x0000000000000000-mapping.dmp

Download
memory/2520-212-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2520-227-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2520-218-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3032-228-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3032-181-0x0000000000000000-mapping.dmp

Download
memory/3032-200-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3032-186-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3932-175-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3932-183-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3932-177-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3932-187-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3932-151-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3932-157-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3932-168-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3932-145-0x0000000000000000-mapping.dmp

Download
memory/3932-161-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3932-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3932-150-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4192-219-0x0000000000000000-mapping.dmp

Download
memory/4192-226-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4496-143-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/4496-137-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/4496-135-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/4496-136-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/4496-132-0x0000000000000000-mapping.dmp

Download
memory/4496-138-0x0000000002060000-0x0000000002070000-memory.dmp

Filesize
64KB

Download
memory/4496-148-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4496-139-0x0000000002070000-0x0000000002080000-memory.dmp

Filesize
64KB

Download
memory/4496-140-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/4496-141-0x0000000002090000-0x00000000020A0000-memory.dmp

Filesize
64KB

Download
memory/4496-144-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4496-142-0x00000000027F0000-0x0000000002800000-memory.dmp

Filesize
64KB

Download
memory/4576-190-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/4576-191-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/4576-213-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4576-192-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/4576-193-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4576-194-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/4576-195-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/4576-197-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/4576-188-0x0000000000000000-mapping.dmp

Download
memory/4576-196-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/4576-199-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4576-198-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/4800-174-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4800-171-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4800-167-0x0000000000000000-mapping.dmp

Download