cybergate | 0e6b47a2926a489b1d1e6ca6e1b21c33a71ffba0f93fdace68e012086b290e40

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe
Size

342KB
MD5

af4dcbd5da65066c6cceb7fabf9ac820
SHA1

0f304f2409127f0ca20a7085e2444fc48e3519c9
SHA256

0e6b47a2926a489b1d1e6ca6e1b21c33a71ffba0f93fdace68e012086b290e40
SHA512

f4b2b756a03bf39bdef08e81894cef50654342e7a29a53b2e001c41fd908a8de3e70c8f16aa6c20fe9f0c8d5fa438628b9ea3e28082ce586b8b2cf2966c1867a
SSDEEP

6144:RJVEe3SzFNd0w5aD/6JzzSJ2pAfznH9kgaRc14TMaPTIc0B6yCOhXHiHuS0o:RJVL34LK2aDyhpALdkgb4TMaP50AyCOr

Score

10^/10

cybergate hawkeye sevenx discovery keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

sevenx

sevenx.zapto.org:100

Mutex

HU5BVJF6FE687K

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
ERROR 1032: incomplete image
message_box_title
Error
password
seven
regkey_hkcu
Windows update
regkey_hklm
Adobe Updater

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}	wmiapsvrd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	wmiapsvrd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{PH4C876M-8UTJ-0SMN-X52J-3U8B480EM0HY}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	adiadg.exe

Deletes itself 1 IoCs

pid	Process
2020	explorer.exe

Executes dropped EXE 8 IoCs

pid	Process
2020	explorer.exe
1636	explorer.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3004	wmiapsvrd.exe
4136	explorer.exe
4568	server.exe
1068	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2284	explorer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1636-47-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/1636-50-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Updater = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows update = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\adiadg.exe"	adiadg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	wmiapsvrd.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\install\	explorer.exe
File created	C:\Windows\SysWOW64\install\server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	wmiapsvrd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 1636	2020	explorer.exe	88
PID 3352 set thread context of 3004	3352	wmiapsvrd.exe	91
PID 4568 set thread context of 1068	4568	server.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4496	624	WerFault.exe	94
4048	1068	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adiadg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiapsvrd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiapsvrd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2020	explorer.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
1636	explorer.exe
1636	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3004	wmiapsvrd.exe
3004	wmiapsvrd.exe
3352	wmiapsvrd.exe
2020	explorer.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe
3352	wmiapsvrd.exe
3352	wmiapsvrd.exe
4568	server.exe
4568	server.exe
2020	explorer.exe
2020	explorer.exe
3576	adiadg.exe
3576	adiadg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe
Token: SeDebugPrivilege	2020	explorer.exe
Token: SeDebugPrivilege	3576	adiadg.exe
Token: SeDebugPrivilege	3352	wmiapsvrd.exe
Token: SeBackupPrivilege	2284	explorer.exe
Token: SeRestorePrivilege	2284	explorer.exe
Token: SeBackupPrivilege	4136	explorer.exe
Token: SeRestorePrivilege	4136	explorer.exe
Token: SeDebugPrivilege	4136	explorer.exe
Token: SeDebugPrivilege	4136	explorer.exe
Token: SeBackupPrivilege	624	explorer.exe
Token: SeRestorePrivilege	624	explorer.exe
Token: SeDebugPrivilege	4568	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2020	3540	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe	87
PID 3540 wrote to memory of 2020	3540	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe	87
PID 3540 wrote to memory of 2020	3540	af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe	87
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 1636	2020	explorer.exe	88
PID 2020 wrote to memory of 3576	2020	explorer.exe	89
PID 2020 wrote to memory of 3576	2020	explorer.exe	89
PID 2020 wrote to memory of 3576	2020	explorer.exe	89
PID 3576 wrote to memory of 3352	3576	adiadg.exe	90
PID 3576 wrote to memory of 3352	3576	adiadg.exe	90
PID 3576 wrote to memory of 3352	3576	adiadg.exe	90
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 3352 wrote to memory of 3004	3352	wmiapsvrd.exe	91
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56
PID 1636 wrote to memory of 3556	1636	explorer.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3556
- C:\Users\Admin\AppData\Local\Temp\af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\af4dcbd5da65066c6cceb7fabf9ac820_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
    3⤵
    - Checks computer location settings
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
        
        explorer.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
        
        explorer.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4136
      - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\SysWOW64\install\server.exe
        
        C:\Windows\SysWOW64\install\server.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 580
        8⤵
        Program crash
        
        PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
      "C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3004
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1188
        8⤵
        Program crash
        
        PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1068 -ip 1068
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
b6cc20cb75e269639fc0579cba480e22

SHA1
19187940bc839d3a50e48719dd41e32db6bda8c6

SHA256
70d97066378eec1f85b40c9bc63ab30b4557a6969f3d1f8c99c69363872e51a4

SHA512
3c5691bd6d1a266edca8159dc9031ec0168033e0a37cc827f65ba68a485eb177dd755e7a06674b98be43385ecc6fda10ae7fa0f5d7e4eb67a8d4328971498cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
dcb032d3d076361161d325ba45f87fc8

SHA1
27c16cb4f5725dfa0631572454e60fbd97cd23b1

SHA256
e08e9e4879a5ffb4bc9ce2cc498749f7d7d5dd78886a681fb322adbb3c8e8265

SHA512
837e85fc37bb4c41d1125313d4f71e6ba1df0bcb94cc014ba648cfd682db5c91968b09b7324c7ceba98cf6b2b6792f844470fd2af7fcb729506473129c94bad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9c3868606e08550ef5dacc5f1a8eecf0

SHA1
aef30728e27550b609b292a6e6d44e85d797c562

SHA256
9692141fa2c5c4a548e7366ee6768ed4e494e67fdb0a7186336e72dde3ddbdb1

SHA512
3556f73c05e6325bc712bbcf84b335dd7db84e627341d804d9f294cc2c2229ccb7a6a5804a773e1ee84dff8bdf42c5bf7a0c7402a1dc3717aa17013d618eab27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3ab66231414577a43077a567931bd2b8

SHA1
3de1510418e0146eaa14b4cc92280b3fff089843

SHA256
959c7ceb6e5b3c6f8c89cea7111e47d97635679ec1bae703a60635bc625ad0a5

SHA512
29f6041a01c86fbb1a3d0fd41966f788097374473861fef714a3304955bfe10978c10b4c0c07d60f39c1d3ed03a6f09f5891b05d2d1f6f6cf22b4b718d7bc2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a6cdb69ed3892851e500b84834fac7f1

SHA1
f5765a5c0938678cfa446aaeb19f5d599987824f

SHA256
5c95bc81ae0f693ba98620396a4890214c8c3983d7a64fe392eac2f73550a1c6

SHA512
03044f4051ba22c746818560981c354625f4ea2ffc188b69df1d97818f71f604de35c6159d6611d6426834132204960c7f3f689bd7eb4e28953a380a7301dcf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d840e87ae6085c5089d357e5b6cfae9d

SHA1
e0bf04e60d2b9fca97755a19b4cd0aeb282b2540

SHA256
60d6e7041ddebbfc3c70a7c1ff0d5129d9739a91cfb83bd67ce5844609c8537b

SHA512
a2f3d19939331e270503d0cd07a3bacdcb00708f99e4ce6ba2d427a5cf6cd5929a7866975ae25c225b28148bfe1ef1bfe78a35efc5ab812a97ab3e741dd8562a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9df658751dd55be7356f7ed7d6316acd

SHA1
b3fbcfdebbbdfed6ef7fccfa5e6e04c49ef848a8

SHA256
8256cff828fc05a2750b31f550a0dd3deaa9b9a21852619bbaa9658d47426041

SHA512
de26722c9da28f640ca6b3a9b5eefe59c17faeb597d3279e6e8a1d7043d5e1243a2deb74518cfc4b86579708b3ff7dc00339990c8835084c94f83ada48346d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
317a75e6207150815801a48432c598ea

SHA1
a98a091302830fb7fb75d789faab5ae370526405

SHA256
02396d0a19de2ae429527c24afa154f25d81a62a5f4996d14052e7df14964c8f

SHA512
337bfde9e1a48b3886e5c1f0b44b33430f8bf8639e76eadeaac9449c27b1af675ca4a53cef7cb9122774edf7d826186750309c25a6dee633110d7c0750c7d7fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
54B

MD5
197138eba11836c718f96715f4805802

SHA1
abf8a6ecc08efbfa52265a9210273ff077987f68

SHA256
fe40ecb66fbd1552d113ccdf5fcaf086233600540ade8409b5a28543c25ba3e5

SHA512
3167e695318b22ec1c423c6ba5ab42745dc4bfe0757a6b6c9a76b193136292c480df86d56e01fc406bb902e008c9e0838c7995d7a4e6e09dd8f75b3892e616a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe

Filesize
19KB

MD5
7557176df708545d6e3bcfe8163b9fac

SHA1
b0611f219736022ded02c0281a40874568c64ebe

SHA256
179b309599d34b6fe68022867e145682eabe751cd0df6930b1ca79e3e48d549e

SHA512
0c405f76c0b2795956e87aff4e4ed5d6addea872cf87098ca8ed892da9cf03e27932f1b3765e191c5b87b6970159dd6dc1498ee02533a454fd3b6faf889b5857

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
342KB

MD5
af4dcbd5da65066c6cceb7fabf9ac820

SHA1
0f304f2409127f0ca20a7085e2444fc48e3519c9

SHA256
0e6b47a2926a489b1d1e6ca6e1b21c33a71ffba0f93fdace68e012086b290e40

SHA512
f4b2b756a03bf39bdef08e81894cef50654342e7a29a53b2e001c41fd908a8de3e70c8f16aa6c20fe9f0c8d5fa438628b9ea3e28082ce586b8b2cf2966c1867a

Download Submit
memory/1636-47-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1636-21-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1636-50-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1636-23-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1636-24-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2020-270-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/2020-15-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/2020-14-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/2020-269-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/2284-52-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2284-51-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/3540-0-0x0000000074782000-0x0000000074783000-memory.dmp

Filesize
4KB

Download
memory/3540-13-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3540-2-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3540-1-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3576-271-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3576-275-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3576-36-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3576-35-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download