cybergate | fc7cd836936be0eb170c0cb634e5462e6e3107bab886ccc8eec1eb964b2f1821

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Size

296KB
MD5

b42163ab99d02bd0da2170880fe50fa9
SHA1

70b7dbdf82699a1f805642e818b656ec24024110
SHA256

fc7cd836936be0eb170c0cb634e5462e6e3107bab886ccc8eec1eb964b2f1821
SHA512

14c38af172532f6a9331dafdaee58583a758b79d6324dc4a40356ccc23778a8086b065ef80e50f5ca07a5a8fe53013eef8ed33368aeb73454e919948be9875af
SSDEEP

6144:/OpslFlqmhdBCkWYxuukP1pjSKSNVkq/MVJbm:/wslbTBd47GLRMTbm

Score

10^/10

cybergate platinum discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

platinum

qwerty12345.no-ip.biz:100

Mutex

722PJ8G1T63870

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
fotka.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
12345
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\fotka.exe"	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\fotka.exe"	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2UW33DN-EQQJ-A3Q6-F480-P3WO4X13CJ27}	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2UW33DN-EQQJ-A3Q6-F480-P3WO4X13CJ27}\StubPath = "C:\\Windows\\system32\\install\\fotka.exe Restart"	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2UW33DN-EQQJ-A3Q6-F480-P3WO4X13CJ27}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2UW33DN-EQQJ-A3Q6-F480-P3WO4X13CJ27}\StubPath = "C:\\Windows\\system32\\install\\fotka.exe"	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
284	fotka.exe
2420	fotka.exe

Loads dropped DLL 4 IoCs

pid	Process
2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\fotka.exe"	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\fotka.exe"	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\install\fotka.exe	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\fotka.exe	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\fotka.exe	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1812-533-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1812-890-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1812	explorer.exe
Token: SeRestorePrivilege	1812	explorer.exe
Token: SeBackupPrivilege	2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Token: SeRestorePrivilege	2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Token: SeDebugPrivilege	2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
Token: SeDebugPrivilege	2460	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21
PID 2800 wrote to memory of 1196	2800	b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b42163ab99d02bd0da2170880fe50fa9_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
  - - C:\Windows\SysWOW64\install\fotka.exe
      "C:\Windows\system32\install\fotka.exe"
      4⤵
      Executes dropped EXE
      PID:2420
- - C:\Windows\SysWOW64\install\fotka.exe
    "C:\Windows\system32\install\fotka.exe"
    3⤵
    - Executes dropped EXE
    PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
4a096959769dddccf0f9bfa4e530b427

SHA1
0dc7cfbd7990765da0b3d2e394919aecc6106e2f

SHA256
4e012074cad8199a6252850b2aae6eabfcf80ac933c110b4035efe066ebc3545

SHA512
7cd41aa2208f2df3c7033e98e28efdcc09158d316e1df3f9d747fd2779388e8ac1b97dd74adbcf9d2e26c17752ee49be0bbcee23fd03097001677877a7dfcb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
55368bcb97d6d01842930e55141f7280

SHA1
fe50af512a01458ed44c41df4e6c5886344ae04d

SHA256
e9ceae63575634172bb8f3b8442a568caba722e4170ecfc893fcb75969510a7c

SHA512
72a0ac844fddb66be968ceb0f03eb57ed39a76f189ba0f092bcc7b2d387fc83d3764067c14110f1fb7a46e27744e367c6bd33cdf34705c66161caca63e366ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
65d20fb6bbfac87ec91e56a4c4162fb6

SHA1
624e2686fe5284ac1e5c5a074ccb96a3efc644c6

SHA256
3b48ea9ebb98211b8e4b4c46058feb7f3bd9e33d7b4aa93ec63eb0bc76657ece

SHA512
7280533ea703da07d92ef680482f00689ea69fc55dadccd2c0f5cfa88e03ea0feddd93315b6f25a3921ab7f9d29cf9e1b16ef3243c4a1fb83b68241dac2667ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
62a75afbabe7dc20aaecbb77fbab1571

SHA1
19303638237d2e47011191f7fa81fb509aabf134

SHA256
b2878d8bd905132870bcd639c54a77ce97a6d5303a844685118a6355eac839dd

SHA512
847cc87ee040b6c2688086d3b10e92fba517a20bf6fcdb824e5cf201f454087bfa6bc2dabdc1b2ff915d30f0ae061d346c5efe5ef3ee107799fba8bbc112c0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fd4f6901eec486f187f2bc222e9bf88f

SHA1
b52ddb894ed9e0cbf2092dd38e28659991c11f2d

SHA256
f114e43ad147d0a5cb0afb1cd791db2da75bbc12f3882e3a73f1a144b5b7d6c9

SHA512
7b4c046d9d4788df754d70c2e8900047ad44bba58757428abe269bf98bd819ae0e53c22da7d9c993c2a0b7df3a22039b782fd925affb16090ebdac2c2950c565

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4b011bf3819f8eb9ac87695c43275ce8

SHA1
50d7622ecb5144740018499838b4f089d1ff2c3e

SHA256
d445b640f5f58eca73383bc7d5b4dbfff84120eb83b4efd87b70af0d6bd2d1f8

SHA512
1acc83b4cf1301f3b1152e3cd928132fde0ad4a99dca1a4ec7ef5d23320a8d1402f6f6f08138e5888b6c6f72d604541efdb250927d9dcaac7997afb3088335f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
db77b89604a073c9417e6756a08cf4ff

SHA1
4807fec7e64ff44c8f3b2b915f7b4f5f5edb7f81

SHA256
630ced368ae1e4f46672f252c7d6574cf394825712e1cedb3029faf51dc98467

SHA512
e9d0b26aefee7e68f445bf35d5684ecbcc9df9c1e557e4b926cbcd1074e73f99c4bd2c8b9b07ba40ff82e4b16edd20e8a42be3e918356d47d02d28fcf3821abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
388b484018c1cdaa6f63318eeb0b8d73

SHA1
1e1dd68ea96667b21efaa625a86bb79023f7cfc7

SHA256
516125d1494e4473fc2ef343beec79924d22dc767db476a3dbcecf2ddbc5c296

SHA512
e76862ff42cd18351c781c4e016dc0970d09548ea015c08cf03f7de7af2a1df3f010da99adb2f831468c1a357b0e20a0392ddb1b791d70613612af753e014652

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
18a6a1f8b66f1a935962f9d269fe4f18

SHA1
f6396ba394f6451e5a7f8d784197600892c46d88

SHA256
0b2f62aa69d86dda00e72a8e5e3a8d5a1c9b2a94ec31c39949625c49a9cac268

SHA512
e07c4bb301bb528bb673061517706f28bd3e9c6ccedf84f0e48d341e56c782120059af6bb8e3f47519c0b665c207b8ba6fcbfa93b352227adbd0e53a90f301b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
bf0ca600919e25aee275bd0f9a903375

SHA1
86dec58d2f19e21787f44f064ded60af7c1bfa26

SHA256
9f8fd099a1d3e726e24a32c3aa3fd7412a213320ab41b5c88d5403dd70ded8de

SHA512
ed3f5ce3d7ad6b97d47251aee86e581ed4acc24cd487543a869be999a0c9005f6ae724883eb2a43989283ca738ec930ac6d2a8b09d0a586e7a72245816e2a8f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
af2391aab7e0f83c949ce9360a7ac840

SHA1
cd14192fb288fb5e64632af7d93d4ef1e431320d

SHA256
6c430559257a68e92549162c682f646bde4b6a63231099c8a647e11a564182cf

SHA512
c642f6054f9c6498db4d7a0f8be1f224a74fe0f081ece0ab7f11289458d1a30f7eff965492af8d3478b2e79250f2a47824a8eb588ec12a488d831523d03ee9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a95221c2f60e2a22bf1f7f25df7be7a6

SHA1
76171f44e9afd62226be671455a27bb5cffcb39b

SHA256
c066199a24fc7143b9731b83357719801ba5aac03758892624d2ed24a3976ad5

SHA512
e3c8e2be196d337a95839364bd1c3b85f6299170c65dbe7bf18370808ce593ac32d52ab6dbb4aabef71bbe4b3d9bd7c0c543489c1d860ba45959a6bfbc86ab34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7eea07e801c2acfa574c90625959b1a0

SHA1
4e42cea30862e08c0d3f72cab25c2e47a467c0b8

SHA256
5ae6560dd0657035da73f5d3d897918af249d02b12a3e24799856999cf819101

SHA512
06bb70ed4645f530088e9ac3c125c4798a4a653ce768947cfa063a23f578b2dffe802bc4d84ef68c68f68309c250a2a8c4ef49c24ba42f2ec456517f8538f4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3529b1e417fee69d1f6836e1f469bf3b

SHA1
2977d488eb944389551e4a9e8530ef47c76b852d

SHA256
60261b927c5949c36d41818685431f80e984342ef2285aaa5d03ded5d89e8f6d

SHA512
f3b34cf401a447afe367b1b9cce21c3fec5ee4aa704ffa16338666fd8b57655ec07e213971305b26cbd42eead2aa4538ee3b07c55dd3942150c2cb96e6a45323

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
019364c235ff914157412578a769bfbb

SHA1
485477117fa6e2b4078cbf8dca9c21fd181d690a

SHA256
dd6fd59ce326f6a87fba05843f663079ddb2ec38d8c8bb459fc2b8b98b62a8aa

SHA512
beafc5e8742a7b07db414689a3ce7c7149043d9b86ece5522035272e4045924e90cb252205aa4f8e737321fb8d8ca8cd61673994fe48d8ae898bab38a5236f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ed234315ec52b91263b235d1ddfc95d9

SHA1
68ab6f1644ca175c0325c45581556011a11307ca

SHA256
7fe99806afaf144a59f1615cdcd6d54366707583f90f712767538e583de7d4a1

SHA512
98c0977cd6312f0a57f2415579a3b61b2284c15f33bcbfdaa77802d0cf576e7bd4d77c99b2945f3be761fce70db0d3fb2ae30d107f8d073138d64c8268ecf951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
b5a61d7c6018dfd6a3a4cb3ae9a3c45a

SHA1
384165e91203817697ed4f05b93f391205145101

SHA256
ee494bbf192f3e052dd2c3024668531567d324c7dc0d941021ef747fa9c0c522

SHA512
5e8b23cde16a919f9875297651b06f3121509ddcaf7dbcac19d15c8a9ffb1af2476ae12b9dd49e2909ebc4889a750230f3e7be19ac03ee28012758f83e4ea8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
94e0e15e82989d7e244314b46b5498a7

SHA1
d9cd822a7781f30bd0b54b589c90562cada9f784

SHA256
66f351464f27aea5cddb649feb0d252121ccbff527af30702e66dc5ea9fd5415

SHA512
2c8e7b228245edc5274137e8f8f83a0fbd3256afa3af27255b8861c941bf48c89c89a92c9bc6a74de8a95991b14d3d33e66e16116feb66550ee39ee585b0580c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
c7d22595d88fc5af3deae966482a3f71

SHA1
cdacaba1bf4ed3118dd0fd75f26cbce8fd1dd322

SHA256
a5215d08e6d7385f5b9c66fcd992ed3496da5a3fe7917cb2f58e5b43310481e8

SHA512
f34dd90ac4213556fe8fa05cc1a899683b94b4f1d523c39ed42eec90e06ba2f0616266732e8dfe3bf309f20bfe74aa2a40f32242a2b1eedb01fc08995f689f25

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Windows\SysWOW64\install\fotka.exe

Filesize
296KB

MD5
b42163ab99d02bd0da2170880fe50fa9

SHA1
70b7dbdf82699a1f805642e818b656ec24024110

SHA256
fc7cd836936be0eb170c0cb634e5462e6e3107bab886ccc8eec1eb964b2f1821

SHA512
14c38af172532f6a9331dafdaee58583a758b79d6324dc4a40356ccc23778a8086b065ef80e50f5ca07a5a8fe53013eef8ed33368aeb73454e919948be9875af

Download Submit
memory/1196-3-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1812-890-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1812-248-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1812-250-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1812-533-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download