cybergate | 12333dbaa7ce6878367c16845e5db72fbdcb6467dd0c427e7578292bcfe7ff78

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Size

2.3MB
MD5

df610a03b36f0b439301340708ff7c12
SHA1

7bd671491ed6cefe88a7dbc4dafb0184c63ffffb
SHA256

12333dbaa7ce6878367c16845e5db72fbdcb6467dd0c427e7578292bcfe7ff78
SHA512

6d8148f1be068182f67d0907f3b43eda6d6623c56d2ee84634a96331d4c9e2fde6f730f0855cb26aa3b9c4e2da06dfb20b3670faa4d6c66bf21c52777a367819
SSDEEP

24576:n+Y5ZjVQ5bc9PS4AqEakfFCnm/+RAvVOGtYJIsVTsoiucnXi+P4pa:n+Y5ZeA9q+Vm/GANZ6Xinny+h

Score

10^/10

cybergate remote discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.0

Botnet

remote

plxstar.no-ip.biz:1337

Mutex

C5M17KYRU5M8PW

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
.//
ftp_interval
30
ftp_password
isaschatz
ftp_port
21
ftp_server
ftp.freehackback.fr.ohost.de
ftp_username
freehackback
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
true
message_box_caption
FAIL!!!!!
message_box_title
CyberGate
password
smuuuu
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{VWMA4PFA-34A2-B27L-PE46-0ARYT38MFX7J}	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{VWMA4PFA-34A2-B27L-PE46-0ARYT38MFX7J}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{VWMA4PFA-34A2-B27L-PE46-0ARYT38MFX7J}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{VWMA4PFA-34A2-B27L-PE46-0ARYT38MFX7J}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
1424	xRIC Public v1.0.exe
1660	server.exe
1720	server.exe

Loads dropped DLL 4 IoCs

pid	Process
2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	server.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	server.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xRIC Public v1.0.exe	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1660 set thread context of 1720	1660	server.exe	36

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-546-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/3008-918-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
1720	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	3008	explorer.exe
Token: SeRestorePrivilege	3008	explorer.exe
Token: SeBackupPrivilege	2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Token: SeRestorePrivilege	2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Token: SeDebugPrivilege	2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
Token: SeDebugPrivilege	2276	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
1660	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2956	1856	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	30
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21
PID 2956 wrote to memory of 1388	2956	df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3008
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\df610a03b36f0b439301340708ff7c12_JaffaCakes118.exe"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2276
    - - C:\Windows\SysWOW64\xRIC Public v1.0.exe
        
        "C:\Windows\system32\xRIC Public v1.0.exe"
        5⤵
        Executes dropped EXE
        
        PID:1424
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Windows\SysWOW64\install\server.exe
        
        C:\Windows\SysWOW64\install\server.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
1.6MB

MD5
ac9121105cdcac8b541ea118eb497bef

SHA1
5a882dfb65ed81c6bc4898936088211765937df8

SHA256
75ffcecd1659226e6f14d0bb5e9a0ebf62927fea8563dc9eac447ab2582a2593

SHA512
adf2df8d080f34822320b0ea88f707a79becec556504bede4686cceee86465da863b76e2b8aeacdee03aeed6daaa27fa5997801eff27463b0ea22d79f8714dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
78c2e387372ceddbf8c9d424a7eb1ebe

SHA1
f95ce7886ace9ef15fccfd87c1ccba648dd74737

SHA256
3485a873a639ab8b9c846dc9d7cd5bf8bef1d556555fe846cf2ed57274c25ecf

SHA512
b91789fa52e6c2ea1b0071f896917933e4d87d9afdd1d95055cb8011e5d65303f29bb0bf47d0e46818e5ef661f8ec91c352a1f3ca537e2ea67cd5adaac7d9706

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
57c2a8d90937834ca924baae5354d630

SHA1
0f649a4dfcf1394af5c5feb0d4bcfadadc577ccc

SHA256
43564f39a5ea52c3cdbccd0116780255538bff1b25956c3dbb071faa2e9a0cb4

SHA512
e834e6ad35bd4724d60bfacc13ad111a7004ff87877efc75fded518f3c2588b36d4ed7ec8da84ab434f3235dfd82fd770e50915bc16bef8549f4e7edb890a6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d404a8b354def35ac93d64b9dddcd98c

SHA1
58e62b59d1d448cf9d2133cfa848de36d456f68d

SHA256
5b514fb843a48cc2e042831e8d8da8822ab8cc53a3f9cca8af0876840b43df5b

SHA512
04bb5022afaafad81da8dfe0b9041903b885f351bc0eae4fbbd4cbacb4b5b4172dc82ea5f274f73c5839009eb14b48de1237fc7235a5ba5444aa1366da026a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9a68f0d79c82302639a6f94fefc1f288

SHA1
77ed62e4756a1e3f7bff0d8277f97af44450076c

SHA256
783d6e9da80fe3cc10461e1a6c782119775cf11cffbbd05520eb82181da18da5

SHA512
6d2293ba91774a65dc53bd6e9deb6cb630180da4baf4d878746036bdda8920d7e0c2dba03baf3940f016b5098ff7fde411060cda42c80b24067958e0d942e445

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
6f87e37cc4509acb1654130eaff2ba4c

SHA1
5d3d5cb9fa81bd417771de62bf45ef011a7984d8

SHA256
4d47f0dbcb0a292b5afce6f7a6dc8b4406738c09291634aa6580d0dd03b71b60

SHA512
ebda3c08890c249202f98d34aac15b41dfcecbcc2ba9c60a57dbcaa9aa5382944f8974b4b91f441a0ca4d86c792883bc6b8a263b1cf135c2656bf4bd3d03547a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d85fe1aef5cc1c9e8e355df70b29f3d1

SHA1
2239914ade265000cddd405633dae475f5778b4f

SHA256
fb0d4aed6204d26f779ee212ed5105f203c155f3d291dc341f547e25be1bc00f

SHA512
a8a9f90ee8954f81ee9411f6f0517d3681eb3dc9706ef3537679654c2996a1a7fd763657ca6cd61a59cdeb49bebd0f835201251104767ae0ce58bb02a41ad09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ec3ba2140fad83d61b21b7c0f708d2a5

SHA1
2193fd4c92784ba4c1f10c5e318f13dcc0b0eb48

SHA256
e022377da09bccedd9c068ed753c0f94c84918b3fe20a73598c9f1b96b9c1450

SHA512
8aa878d6fe7ab86bf1f627ebb051baab9657a75107b93618bcd6a9f3ea4b29e6c279c624ae10369a56f9c0bcee38680ed5e4594725340f182c4df6343dbd1e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1cc9918101d30614cc63a3fe70bff559

SHA1
7f0407ef6da31f83f7dd4802c9f1612d46c1f7fa

SHA256
77d228a73cafeab50e309ea0147826b7bd941bceb1f025b6fafcf083dbc30f43

SHA512
4322439cec7262a8c8651bbed471951cafc0802c93daf4699d79b3a1c942b46317eb2b5e57f91104508960717737b21f0a164b08d2c565baad2a8b6a71e9f734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3e9110378d8eae25725e89dd552cd775

SHA1
7d4e33ff9797b0045dad21fe90a3975955c0f688

SHA256
cc008902fe6644c9d015cd49788dd8cba531155bf40c5d809e0389a26aced789

SHA512
04999155984b7b8d34215af2f67145b2dceb6283980afdd3fa47154720939163af9517e351a6350df3d15f2f05173a3e3d8726321c2d1704669e7b14e70db86d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d5633d53982ebac71eeeeac0993968ad

SHA1
07b9a5dd6f3c836a41c5e60ec519831b402aee9e

SHA256
f1c88d37f01421c1bdbb8101e4ad5e7bf1afdffc199dd263f16976218abeb9b7

SHA512
e734c7abd79a56ab9db0913b3e3c083578b0fcd998e94142ad2002e4651804411e44d6abdee8e86eb067d22cbbf87f5339feb801728fa3df878af9b1b06082a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d85f473d0fba72cb1b14bf6b2ab4f427

SHA1
3f2a9f0e3bc95a3d1b49a79b5dd514913a62d9ca

SHA256
8b664be4eedb32a9b984b19fba1332b03e7dd1a83398d31dd45decff772a6622

SHA512
36c8980dc07e41f24ac7d6b36e3f7557f9fa94f7bd1f43f0998270ac17ef9e80abeb3a3de53cf019e8c5e1d7b37da6e5bc580f941bc4b1af4f17c1ef443755b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
95280100bc5ff9dea01c5bcb3fc6fd8f

SHA1
fd4b91d76e306e8ea944b03cdc432da5eb639072

SHA256
9df392fddd4aeb48ededb3ef9a584364fa62413915bc5fc81846548531669e6c

SHA512
8a56d02878e17e7f7fb41af52eec51c2c537302112392be8a820bb8a86050d8a92677c621867b9041ebd73a9f8804679c9bcf5766fccdbd54250fdd81e136878

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8c044c93ecca8252da2cd35cffe291ee

SHA1
d907d302ef4542580ccc7285e78020578a6af951

SHA256
df13dd39635ed1e6de00afbfb44b5252961f7cf6abf4c9d75c8cd17e7f070a2a

SHA512
003a59da6c4d7653244223ec0a3996678d71c836c7ab3e2eeecc0c308c0fcee611584001f19333d58645d46121d8315852b20d12423daec7f5f44f814452ebc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
90390e720cfe810046c2e74e74d83636

SHA1
e6cc019a41bc86a6553ca9b47b1456076b39f60d

SHA256
39d9b698680507474500d9d66fcc98a1cf523f7836453dfae211403eac628d8b

SHA512
07525579d0c3e34a4091a0478a260d6f169a2381dff94d66a555b566de69e1af9a4db8dde47fa07550d780028349dfe8ed68de7b93a5a71d488daa90f0cd0569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fce651f5016755b888cc98bc34070e53

SHA1
66d3df0004c9d10979984850b7aa5f24c85e1d3b

SHA256
e1f6a6cb6da096d4d4da52561d547ff7fc8d40509ff36f93b70234f92a9f6879

SHA512
e93f1a93e2350ee34f6161d581665bc99b8f530a96ca9f4f387fb99b9c12cde56ce1b09ea78fcdf44290d04e70866bb4c23589c5ec8ce82db47e3d3403930850

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
6d0b30c8ebb137982df138e553e0c6f2

SHA1
f4ae482accdd1e3e3b1f583e402232176a4feae0

SHA256
de4753916cd504cb9d1e291f1119d3467ed01b4efbdacfe67909fc3b28b4fa78

SHA512
da35cd26cedd9b4bb69096b5b4bc9dde7d0c4777734a5ed92fa35d998d60b9beaa1571ee3cb707375dffc59406a6217487c673d1c6908c0f19251cec726adc4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5b0f87024d840a857abd003d205a3b2b

SHA1
849fb7c9df60608f564fc50e17dc47292acdaded

SHA256
911cd2e960478e38c2df67f4c0f18ebd17a6d9d3d4b433ef2a55520759ef95a1

SHA512
ffb485835d1897cd3eea6b921b1a3bb2e3e659b5e706c1303a82cf299064481251a6a596cd395fb2b1815148a6581c118cd9e0aa6ece8ef38b92c9c917eba370

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
6a5c3f14abc8b4e1aef775107a0c92c5

SHA1
396d1420b1d3cf5006f94fc8aeaaeafe61a11410

SHA256
7aadcb0c8da268138a2d1bb9ded27f3f1562a8014bbade1454da9680f8933f8c

SHA512
9292cef7d757088dc5cf957567fdb9cb611e8032df50690937b1882cde4634f60213139654a3ea6d12fe7f350246ed33ffcb185784da95bc9abf3bfae9e5ffe9

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
2.3MB

MD5
df610a03b36f0b439301340708ff7c12

SHA1
7bd671491ed6cefe88a7dbc4dafb0184c63ffffb

SHA256
12333dbaa7ce6878367c16845e5db72fbdcb6467dd0c427e7578292bcfe7ff78

SHA512
6d8148f1be068182f67d0907f3b43eda6d6623c56d2ee84634a96331d4c9e2fde6f730f0855cb26aa3b9c4e2da06dfb20b3670faa4d6c66bf21c52777a367819

Download Submit
\Windows\SysWOW64\xRIC Public v1.0.exe

Filesize
1.4MB

MD5
ed80d3cfa92a4f861464d2bfc985465c

SHA1
034fa293e5d3a2d97af89cac63639321c97150e7

SHA256
a80daccda9f34c6d1fca72b7005b7481bc2bcc8dc84961e57c2d32ba73021249

SHA512
d0722ab4fa427813d6bdece72326eb1cd7fca8be98fc0a8b679c25b95573acc81ceb6888be1d3df5768f9d5425e3ee124e6655d47b16ac99c29efc94b6ced14e

Download Submit
memory/1388-9-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/2956-3-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2956-5-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2956-4-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2956-2-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2956-878-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/3008-546-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/3008-544-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3008-255-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3008-918-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download