cybergate | a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe
Size

2.9MB
MD5

c07d08d58f7d4eb93297ea598c17d174
SHA1

bbd34de2013142d839344b94945047b54f4f3a32
SHA256

a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6
SHA512

d06cde9ad0768d43172fd6b71949bd516b0383dbda7287de2c7c5a845986e27d6c45b3900432008f44470005ec0969963881a4bb5ac17f3024cbc76d26f4dbe6
SSDEEP

49152:UG5w8C2NdnXJGLKKDQzeFivVRk4OoBl31cP:UG5w8JdnI

Score

10^/10

cybergate isrstealer remote persistence stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
wmilan4ever

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

oxygrapics.zapto.org:1563

Mutex

60C5T6L0DNX6W6

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3796-156-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/3796-164-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/3796-169-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Executes dropped EXE 7 IoCs

Processes:

DARKFANTASY PEGA IP.EXEFB_PASSWORD_FINDER.EXE1EFK.EXEFILE NAME.EXEFIULES.EXEFile Name.exeserver.exe

pid process

1192 DARKFANTASY PEGA IP.EXE
4752 FB_PASSWORD_FINDER.EXE
4656 1EFK.EXE
4748 FILE NAME.EXE
4180 FIULES.EXE
1880 File Name.exe
384 server.exe

pid	process
1192	DARKFANTASY PEGA IP.EXE
4752	FB_PASSWORD_FINDER.EXE
4656	1EFK.EXE
4748	FILE NAME.EXE
4180	FIULES.EXE
1880	File Name.exe
384	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T3804S8H-5BB7-0242-6FXD-G1J02HKB3UL3}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T3804S8H-5BB7-0242-6FXD-G1J02HKB3UL3}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T3804S8H-5BB7-0242-6FXD-G1J02HKB3UL3}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T3804S8H-5BB7-0242-6FXD-G1J02HKB3UL3}	vbc.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4324-172-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/2352-180-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4324-177-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2352-183-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4324-185-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4324-190-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/1556-194-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/1556-199-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/1556-203-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FILE NAME.EXEa71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	FILE NAME.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exeFILE NAME.EXE1EFK.EXEFIULES.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows applicaton = "C:\\Users\\Admin\\AppData\\Roaming\\File Name.exe"	FILE NAME.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\""	1EFK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\""	FIULES.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe

Drops file in System32 directory 4 IoCs

Processes:

vbc.exevbc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

FB_PASSWORD_FINDER.EXE1EFK.EXEFIULES.EXE

description	pid	process	target process
PID 4752 set thread context of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4656 set thread context of 3796	4656	1EFK.EXE	vbc.exe
PID 4180 set thread context of 4324	4180	FIULES.EXE	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

vbc.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe
Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

vbc.exevbc.exe

pid process

3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
3796 vbc.exe
4324 vbc.exe
4324 vbc.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

File Name.exevbc.exe

pid process

1880 File Name.exe
1556 vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbc.exe

pid	process
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
3796	vbc.exe
4324	vbc.exe
4324	vbc.exe

pid	process
1880	File Name.exe
1556	vbc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

explorer.exevbc.exeFILE NAME.EXE

description	pid	process
Token: SeBackupPrivilege	2352	explorer.exe
Token: SeRestorePrivilege	2352	explorer.exe
Token: SeBackupPrivilege	1556	vbc.exe
Token: SeRestorePrivilege	1556	vbc.exe
Token: SeDebugPrivilege	1556	vbc.exe
Token: SeDebugPrivilege	1556	vbc.exe
Token: SeDebugPrivilege	4748	FILE NAME.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

vbc.exe

pid process

4324 vbc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

3796 vbc.exe

pid	process
4324	vbc.exe

pid	process
3796	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exeFB_PASSWORD_FINDER.EXEvbc.exe1EFK.EXEFIULES.EXEvbc.exe

description	pid	process	target process
PID 4640 wrote to memory of 1192	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	DARKFANTASY PEGA IP.EXE
PID 4640 wrote to memory of 1192	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	DARKFANTASY PEGA IP.EXE
PID 4640 wrote to memory of 1192	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	DARKFANTASY PEGA IP.EXE
PID 4640 wrote to memory of 4752	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	FB_PASSWORD_FINDER.EXE
PID 4640 wrote to memory of 4752	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	FB_PASSWORD_FINDER.EXE
PID 4640 wrote to memory of 4752	4640	a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe	FB_PASSWORD_FINDER.EXE
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 4752 wrote to memory of 3620	4752	FB_PASSWORD_FINDER.EXE	vbc.exe
PID 3620 wrote to memory of 4656	3620	vbc.exe	1EFK.EXE
PID 3620 wrote to memory of 4656	3620	vbc.exe	1EFK.EXE
PID 3620 wrote to memory of 4656	3620	vbc.exe	1EFK.EXE
PID 3620 wrote to memory of 4748	3620	vbc.exe	FILE NAME.EXE
PID 3620 wrote to memory of 4748	3620	vbc.exe	FILE NAME.EXE
PID 3620 wrote to memory of 4180	3620	vbc.exe	FIULES.EXE
PID 3620 wrote to memory of 4180	3620	vbc.exe	FIULES.EXE
PID 3620 wrote to memory of 4180	3620	vbc.exe	FIULES.EXE
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4656 wrote to memory of 3796	4656	1EFK.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4180 wrote to memory of 4324	4180	FIULES.EXE	vbc.exe
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE
PID 4324 wrote to memory of 3064	4324	vbc.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe
"C:\Users\Admin\AppData\Local\Temp\a71958cec799236aa1df12b64c3caa213ef7dc970fe6dff7ae679e6efb5a02d6.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\DARKFANTASY PEGA IP.EXE
"C:\Users\Admin\AppData\Local\Temp\DARKFANTASY PEGA IP.EXE"
3⤵
- Executes dropped EXE
PID:1192

C:\Users\Admin\AppData\Local\Temp\FB_PASSWORD_FINDER.EXE
"C:\Users\Admin\AppData\Local\Temp\FB_PASSWORD_FINDER.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3620

C:\Users\Admin\AppData\Local\Temp\1EFK.EXE
"C:\Users\Admin\AppData\Local\Temp\1EFK.EXE"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3796

C:\Users\Admin\AppData\Local\Temp\FILE NAME.EXE
"C:\Users\Admin\AppData\Local\Temp\FILE NAME.EXE"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Users\Admin\AppData\Roaming\File Name.exe
"C:\Users\Admin\AppData\Roaming\File Name.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1880

C:\Users\Admin\AppData\Local\Temp\FIULES.EXE
"C:\Users\Admin\AppData\Local\Temp\FIULES.EXE"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
6⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
7⤵
PID:1592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
7⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
8⤵
- Executes dropped EXE
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1EFK.EXE
Filesize
516KB

MD5
58fe8af8223b031e0f8c022ae0da7207

SHA1
aa009481aa28a86d8d8066ed04db8a4e59c935be

SHA256
635a7fea437c23f878eff7bfadac8e40acb5ac879c67a2498b65103c2c7f3a6f

SHA512
680fb82d7074874be62ae661b2b1a11c0ef9a4c00f200f79663f5f4416227ab3f25d34da3678071ed620e545bbde334fdc6c59567527fdc6c382d385dee84485

Download Submit
C:\Users\Admin\AppData\Local\Temp\1EFK.EXE
Filesize
516KB

MD5
58fe8af8223b031e0f8c022ae0da7207

SHA1
aa009481aa28a86d8d8066ed04db8a4e59c935be

SHA256
635a7fea437c23f878eff7bfadac8e40acb5ac879c67a2498b65103c2c7f3a6f

SHA512
680fb82d7074874be62ae661b2b1a11c0ef9a4c00f200f79663f5f4416227ab3f25d34da3678071ed620e545bbde334fdc6c59567527fdc6c382d385dee84485

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
205ec9c1ba7eac1d9eca7bfe44e3c35e

SHA1
37da8bee11bb689530a8ff00e785dc6bc4ddaf91

SHA256
3137395ba9e1433e6d04d9a466616c63fd737c9356dff81cdb511cf59868951f

SHA512
8419f05c181d852808824fe60eba9b0f64da0bfdd6d03fb7336eaaf11a1879dff4b7695ceb040beb0e915794a907bcf01816ae7cc5e2d32b87adf7c8704843a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DARKFANTASY PEGA IP.EXE
Filesize
429KB

MD5
1927d5cc840c0d57783945e0b25c220d

SHA1
323a4d8b332aadd86bb64a045326c24780eacacd

SHA256
bae576693d58482f3f2e90fbff5b786de3329c9e05aa190d26e64b3aa5327f65

SHA512
e44f15fee82883015d6602255146be3fa9ce8f5fef6cb2fd16e303cf9533be23c343eadf75c0276efe47b8befe8ebb53c36fb8d4ca8876c40e2935982b9ab07b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DARKFANTASY PEGA IP.EXE
Filesize
429KB

MD5
1927d5cc840c0d57783945e0b25c220d

SHA1
323a4d8b332aadd86bb64a045326c24780eacacd

SHA256
bae576693d58482f3f2e90fbff5b786de3329c9e05aa190d26e64b3aa5327f65

SHA512
e44f15fee82883015d6602255146be3fa9ce8f5fef6cb2fd16e303cf9533be23c343eadf75c0276efe47b8befe8ebb53c36fb8d4ca8876c40e2935982b9ab07b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_PASSWORD_FINDER.EXE
Filesize
2.4MB

MD5
1b8393f0ded50ce1ec6c6d798513e291

SHA1
b539ce340f200e10db6d75366d83d789c68e42ec

SHA256
f0065bcc8f2b8aa398a8cab589e9f2f1301806d6be755e00775a2ea63bfd7b73

SHA512
c58b1eef1e290a79f39c561f7e243044c2228236aed5d2aa082610a6793ca9fbc7319f0e37859bd29a7470cc6808f857e2d624b6da4cb589abc6c14d4975dec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB_PASSWORD_FINDER.EXE
Filesize
2.4MB

MD5
1b8393f0ded50ce1ec6c6d798513e291

SHA1
b539ce340f200e10db6d75366d83d789c68e42ec

SHA256
f0065bcc8f2b8aa398a8cab589e9f2f1301806d6be755e00775a2ea63bfd7b73

SHA512
c58b1eef1e290a79f39c561f7e243044c2228236aed5d2aa082610a6793ca9fbc7319f0e37859bd29a7470cc6808f857e2d624b6da4cb589abc6c14d4975dec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FILE NAME.EXE
Filesize
184KB

MD5
ddb0b9a42a8857ff68c9c6329e304b6e

SHA1
402ffc9fac6272ce7293f52944b68f5691f03dfb

SHA256
c9ba7e473c261849b32bac9cb89a4c05a916eef48f6799a9112b6d58af331449

SHA512
33f3e0b6493905b22839c1af28a8814c55bd321527169937b3c1885540c4ff6d347106bf20cedd39fbafbbba538e33591cb3e85ace863e77be7ef596119079b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FILE NAME.EXE
Filesize
184KB

MD5
ddb0b9a42a8857ff68c9c6329e304b6e

SHA1
402ffc9fac6272ce7293f52944b68f5691f03dfb

SHA256
c9ba7e473c261849b32bac9cb89a4c05a916eef48f6799a9112b6d58af331449

SHA512
33f3e0b6493905b22839c1af28a8814c55bd321527169937b3c1885540c4ff6d347106bf20cedd39fbafbbba538e33591cb3e85ace863e77be7ef596119079b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FIULES.EXE
Filesize
1.1MB

MD5
c817e3bcad232a677f8aac0188b99fae

SHA1
315403977b018a0dc15bf964b857b56f36754a09

SHA256
8bcebcbabbd12872f4063f954f910ad5536b4c649fb1196df7558235933db717

SHA512
2655ebb6435cabd23f38c12404a7938bf5eaa9bc118b02b1d5cf0fa65b94fc26b093687b2577e519773d8cf58e12bc233adf37cdcccf5096769ce77a0dff76cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\FIULES.EXE
Filesize
1.1MB

MD5
c817e3bcad232a677f8aac0188b99fae

SHA1
315403977b018a0dc15bf964b857b56f36754a09

SHA256
8bcebcbabbd12872f4063f954f910ad5536b4c649fb1196df7558235933db717

SHA512
2655ebb6435cabd23f38c12404a7938bf5eaa9bc118b02b1d5cf0fa65b94fc26b093687b2577e519773d8cf58e12bc233adf37cdcccf5096769ce77a0dff76cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
c817e3bcad232a677f8aac0188b99fae

SHA1
315403977b018a0dc15bf964b857b56f36754a09

SHA256
8bcebcbabbd12872f4063f954f910ad5536b4c649fb1196df7558235933db717

SHA512
2655ebb6435cabd23f38c12404a7938bf5eaa9bc118b02b1d5cf0fa65b94fc26b093687b2577e519773d8cf58e12bc233adf37cdcccf5096769ce77a0dff76cd

Download Submit
C:\Users\Admin\AppData\Roaming\File Name.exe
Filesize
184KB

MD5
ddb0b9a42a8857ff68c9c6329e304b6e

SHA1
402ffc9fac6272ce7293f52944b68f5691f03dfb

SHA256
c9ba7e473c261849b32bac9cb89a4c05a916eef48f6799a9112b6d58af331449

SHA512
33f3e0b6493905b22839c1af28a8814c55bd321527169937b3c1885540c4ff6d347106bf20cedd39fbafbbba538e33591cb3e85ace863e77be7ef596119079b8

Download Submit
C:\Users\Admin\AppData\Roaming\File Name.exe
Filesize
184KB

MD5
ddb0b9a42a8857ff68c9c6329e304b6e

SHA1
402ffc9fac6272ce7293f52944b68f5691f03dfb

SHA256
c9ba7e473c261849b32bac9cb89a4c05a916eef48f6799a9112b6d58af331449

SHA512
33f3e0b6493905b22839c1af28a8814c55bd321527169937b3c1885540c4ff6d347106bf20cedd39fbafbbba538e33591cb3e85ace863e77be7ef596119079b8

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/384-200-0x0000000000000000-mapping.dmp

Download
memory/1192-132-0x0000000000000000-mapping.dmp

Download
memory/1556-189-0x0000000000000000-mapping.dmp

Download
memory/1556-194-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1556-199-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1556-203-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1880-195-0x0000000000000000-mapping.dmp

Download
memory/1880-198-0x00007FFCA9390000-0x00007FFCA9DC6000-memory.dmp

Filesize
10.2MB

Download
memory/2352-183-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2352-176-0x0000000000000000-mapping.dmp

Download
memory/2352-180-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/3620-139-0x0000000000000000-mapping.dmp

Download
memory/3620-140-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/3620-142-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/3620-141-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/3620-144-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/3620-154-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/3796-169-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3796-155-0x0000000000000000-mapping.dmp

Download
memory/3796-156-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3796-164-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4180-151-0x0000000000000000-mapping.dmp

Download
memory/4180-167-0x0000000073F10000-0x00000000744C1000-memory.dmp

Filesize
5.7MB

Download
memory/4180-202-0x0000000073F10000-0x00000000744C1000-memory.dmp

Filesize
5.7MB

Download
memory/4324-166-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4324-172-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/4324-185-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/4324-177-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4324-190-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4324-193-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4324-170-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4324-162-0x0000000000000000-mapping.dmp

Download
memory/4324-165-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4324-163-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4656-158-0x0000000073F10000-0x00000000744C1000-memory.dmp

Filesize
5.7MB

Download
memory/4656-145-0x0000000000000000-mapping.dmp

Download
memory/4748-148-0x0000000000000000-mapping.dmp

Download
memory/4748-168-0x00007FFCA9390000-0x00007FFCA9DC6000-memory.dmp

Filesize
10.2MB

Download
memory/4752-143-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/4752-138-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/4752-135-0x0000000000000000-mapping.dmp

Download