Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:45

General

  • Target
    jaffacakes118_Kaspersky KIS-KAV New Keys 05-07-2010.exe
  • Size 287KB
  • Sample260910-c81agavbqa
  • SHA256 d0522f9ca1eeeedf65980f8309c465ebc1a43b7bd86a8b2d741b57a76a49189d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3272
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kaspersky KIS-KAV New Keys 05-07-2010.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kaspersky KIS-KAV New Keys 05-07-2010.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kaspersky KIS-KAV New Keys 05-07-2010.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kaspersky KIS-KAV New Keys 05-07-2010.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2208
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1108
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:544
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 540
                  7⤵
                  • Program crash
                  PID:864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 544 -ip 544
      1⤵
        PID:228

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 d0522f9ca1eeeedf65980f8309c465ebc1a43b7bd86a8b2d741b57a76a49189d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 f9051d3a152ceabdd0f9119f07a599b7fb255f688bdc3c9aa17da5a2a2e278bd
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 6bcf0929c7762bc34b71395574fa421a9d8c1a522e92606df23a16841ba58907
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cecd0b84df4198d65cdd856ea5ab2de89e864ff5a691074d6c3f5d5ddfbc3ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2344edfa0dabc941ec15d905ba5033e4c2ea243b89ea734c128cf7d7ca0bdaa1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c621e3af7cf1eaa8ab89918ea0aaa5a0c59f946a494a63d744370e62ed7bd6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f852bb40134c16a430589d9702ae65e8a5e8329d6106c6b230b9c6ececcecd52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f996645e10c6428d35b9e378769535978f0d502618662f17661de36f03aec6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e540bb77044ae4bc5b689bca5fae017ae925b059f109a0e296fc1b612c8971f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74a341cf82adeab0dc4385044fa3e9ef179eed0a9153a0f8961f84196fb5a321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff2605c9525dbbcbc2490628551c058ba86549742e28c25a69c880b22d8528ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5897a4569d215365ff05d54f2a83e51717f47f770b55992f8051ce12254e3f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b786d18cb9e7cedb68805484eb4a162a38f4e194f9e1f2f5463beaf7864886e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b08e22782648412ad108f04b709015a3796d26b17bb1d665139938b720f4b94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ed0532ec4df0118e7a0530a99b918cbdaa109c35eb9357e55ba98db48d94cfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bd900cb54c61397656afd130bb5e6b11afb886894a244d0f68dee9465af18da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f595e6ca03f04ec1a93add4795214c307c6b455af6fc5f0ea1b71b6b1c014320
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69d8620e95b994cc5566889c42574ea6a90469d3c008a658cc18b895d62db26a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8562316eb8abd201d24c9a1e77c8b414238ecefba728a56cb8487f2fa9ab5414
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83fd67b9eb119e292177975957c0693b15cccfdbd0d2a99abffcb8f56c29847c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00f491b6e838b414557660e87ba68a1bb3624d29a12933743d38e160c874c84d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e38ec81a81cc0cecf4f47a1d997f8ffee095cd128b9a80892513dd25c617ae41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f304e63fa3810af68535767943700b234901df4ed4ea4d5aee4a6fe78d257fe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35b71ed410a2d0136655ad2238b36259386a7bcc2003b1cc0d75f7965785ff07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ffc4a2a35f2e4a85a2dea44a78ba915da2231eeca84386d7312b85a34e3b8b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf7c0dfa7970547f19db1179c84be101d1fec96c3455e11bb9521654b03a72c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba3a2e086428b75bd9cf9eeb3a8b77b376bc342f2f88dd542d27966eb668f2da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97fb2254ecbdd331819498883c9d34bf276c09ef36b6c71976aabf76b7d8add8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffbb98aa486468dbe902e8a2a172828beb9ead1fa7b6b9fe63aecaafdc34595a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 467662dc6f01ae6a847cab656e9994f2760f340ee006f8f219613b7967516a59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c86802a859ff0546cfcaa4d06a6ca7f6c08dfe9f862bf1372ec52f53de5dae91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 110f70d17456f025904917369c3547031b4af7e905f625ce2ac7b97894caf380
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06d10730b39ee3faa808ac54d4fe008529b54b58e2ec509b0fcbd8865acab289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11aa57b2445a3c65ad93fb18c60138c3ba568a4b9fa3080105bd6806ba4f43b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ff7e8778a0ec2ef9bd24c69d56ea71ee308f0758059b9436ec5ab0e3f20abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c00372e04b9076a028b57db15fe9ee514eaa9c399d83894e5f99db4f82cebd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bb15803cc003efe3263576dc92bd8a6e50844d0ad4a830c1540b696516f3699
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee33d62d3bf6f0126253603e2bf8f231c667ad586aa4e5441430115c81937ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a9ff662bea40489f4abe098e5d26adf1b7b77901483fc443d8e4a062dc6d20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 196a4c06f9272d22901d0a0417091016bb980c8d3e8f82543c48e0f6df198a8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 daa1b368a9195f77ab5a9f80f2ee2324341962e399e759810ab2591e4ad97698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6fb672f2eec5207756cb6bb0a77d59a8e67cb2f4c81dc7742e9008638cc1375
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fe0184ff75c402715d39928f8f2051b74d8468f4ead4632352bb74de96abb8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c42f7b7f591c5e309876d6345b61f16cb8ef43bbdb705c98e11819116596d41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d7f46c8b63a202b7aa3e30820a35732024c2411f6f23a3f01910086efb6c245
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65a056b08a9742d2cfa83319a14f05d30b333dc7a2716a2bc3275969d456bee6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d695a1eb4c9273a35b60cf3bfb880f6db718f18527f85d3d7efea68d610acd9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fe126357efe6662380991872560ae6913dfe1ba6057b069c8373565feb1027b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09e091fe30eb84d4820db36616ce4d1868a3375eec8b57c17bad2f2f2d6aa337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 215aef121d6721afcae7c261c264fabb0bfdba6bd8a93ba9ea09a1ec4723ddd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f70ad6e8a9b64f2fa92d9968da3fdf18f63a81f05e2d87b67be2607b9f2ce974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b20197cf5186cce47c2492e3aa9142432716497b0b1adac1bf981897167fb16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4124fbe43b47dfc551c6abba5fe6438ae6697cff8f9b019e1d5c7e89e9a27a7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9acc0667bd0fb254089de06f6b175e564acc5324cc24fbbc581ea02864ce3f4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f16247f721e89c0110ed7d0428e64cfbef887c0a20a9e441be229f566f2acba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 febb4b2ec1cb600eefa84e9be94117ef3f56c7756ed1309b906b2eff377200f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4f2b7a1552c5178d4698815a0f2822a565f886cf4ec167fae98fcf5fd9bb7c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 169aa62fcdb2726cc9500b3d2be2bd2e1f60ff5324b380e2471a1eaff4509847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73f774822c38649cd08625ef5c1a3777176975dd2f4e8e7ab09ca6c0f780fadf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c7d6625f7f73ee198660e890388e62139335b7007c61bdb35e112fffed75779
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d1205800b95b75b1ef95cdf6db2f39aab3b531a21267103689d0889ec0f1fa0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dd62b83a96a1c35318e3686dd956465195be2f9e913584187bc5be6d722cfda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ca8be151d41064c9be0b431372685a4266a7967379d2435e372a0dec94fc3a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a92f89b4972e31903b462272fe4f40c4afe067662ee04bd0fc6d267e9a8b695
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d99549e384bd06e0949b1ee5a2f5dc6930f0b39ade834911ca330ba63acd2c87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68b7b4231fca24226aac64ab869657d917405de2e4c09dafd42d1a48878c1ba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2273244c17ff4a566d39f2a378bc73564574d805a65f56e9125a67b34ae3d97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d068d011846232b516c7e8b0378644b687c99f12ebedd0b7d520f7561ecff187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5784e49b3f109c1cdaafefc43aec149db71699c611c07b6310dbc8cd963c98d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04b5cfbb4c75cf077dcad94aca0b93a176d33a343c4b9158dd5ae5edf41f266c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24232107fdf48440746ce1fc338ce7ceb8b47a0b24224a71a2b237cbee09214c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a996e3338083b17478c6cdc888acbaa23da718350c9e4d554f6cdd31f72c8243
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 812c5cc14cc2710555ec65c1ddb4187cc76a1985e5a977e18526de743bec26ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 324375ba2c93c6aa9d41c387484450b5d20e9aa4e49664c1d19c886c2e4f5646
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42720f0139ac9155d24ce203c6632865c2da9d814be88bda69f4176bed3eb090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d007a87b5e45ddc94bbbfdead14a2cd4d839bebf0d6cd7262da704661913bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75d636de91ca1d4a4bcacb1736b321c5419dc25db36c94082f49a265df94b03b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1972f0239ac48a2bcbdc55c2681041857265dd52644d6ac024b4f8a11b41d297
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c050f237ad762a648111b8ef7d77c5fa2ad440022027efac0304d98a2db5f9f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 276c0fbe67b3b8dbfe8224122b0b92328f69696b41c4bf605061680d7fd40df7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ba68389ebb957703fc57163a537f81e7b8ecb44d868f486222fce24461dd8f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad95e70f09c9ce031ab969272c53dcb5f63772eae77d6934d0fa5be0214ce567
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 634b26a5c84ac0f8f962d627185a9ad967ea2ac749bd338fabe2897773bf4852
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcf827e887f06439aeb59fae54e20370e6add3121daeacffdb2a9896a7337101
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f61b2dfefaf2f6e89f1b2bc3b6af2608d2c5b32a00924a409b512c82b1dddfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed82279029c2b5e5f785d75c14e5bcf199117a57947e107268af8d5329bf2fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8570909265d496a617eec32f22d9f3d579c6c9f4fb77647569dd6645e355ba15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a9475094cffe55b30a5ecc6575eaa46f95d3880b4fdac29f7aeab2919163d51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb11a381b0c724d1d3423ee46a0b982dcb11397529b97237b2022d2526abb91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4693af77cc5aa56ab735e76ee0a59f2ffd4d7bb472b7322a5cce6a03ec3214f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c950d0d6b64ac0780153f28ce035accd58905ce850a0bfd76f7873bb24160cac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97e4081b0f69fee8ac5266b479ecc39203e5a76e243ce1734132f06b81e9634e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9f9625d76b564b59cfd2347985399fa6a181bf77728f8a06b3580cfa2c2716e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd960405979bb521371f51866b5c7d3e3a56dd9b5bfbff8da39798862d22e7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e068e1e95deb4e30413df81cfed34c7f10ba68cce4514501568bf08ff1cf7eb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b96606bc0c49069d29da90449966783ab5138ed7570611eed0729bc30750605
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98f0c1cc533247a066ea84455cb910c85a06413f1becea416f5eab4bcecef527
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83d7be389418ca65dabaa728a30e0eb6215a7d5d42c81162ee1a9e45a03744ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c65f6d393b7a95d78978e424eda4d2945c32bf601f7e980fd01a90d8c7c927f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bed494757a11747157942ab26be19e1b00142f9958903cdcb8379d23cea8acff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ebc9f078cd07b4795742fe98c883808c56f483de03b566fd1cbde40d9dac10f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6222fbe546758808bc66803de043537c3961332d005646dd86ea70b9dc00eafe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d005dab52c1c9319967517b0b9cec87519fb1c03d0e90293c8d51fd26b50ff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd00b0afa3f5236dbcd31c2dc7a8c1908b63fa4eb467f8757a7486060947fd0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 706da954a448d94ec44b4b114c6f029b2398067ed989c7afd4e43023b89add6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd88d258e4720fbd71ad69020bc9a99584ac38b87a378fef734f619ecebd3d93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27cb9c3c2481999c5920d18af035024f0622b7440b7a793eccbbae640f932b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41ce176c7925369174b9476a2ac2bfa0057d7f2c2e4cf664679f07a57ec3eb7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8244d68b37bf02386b0d3c1e6721e94936b13e158058f79dce81993525372b53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c50fd63ca9bb58af9181b7718cf0794090ff731288509b695e331a7281f9608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ea1783b9fe774337956f592b38a70c8a36f7b8ce8b313ad93e704836e55d3a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f91e3aba04200c28f80df011289084b291396c96d955821867281749e0767a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5046315a84ed18dd45fb7a0c12bc10d1c8f35385dd3f15be7745cd89c30d1c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd6cc6ad8a13e52a23e79f6709bfe1508371891d2b5a5e863f9c99abe51f93de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb02d3507339a340d09ea5ab47477c10dd5e73e70c1200dc6364402bf3038303
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e44231f8277f9ef89f280fbfe8fb6b9dba36baba1201659a84faf022f23568d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da28f1b9cdfe770e6612fca9cfdb76d164d0bf1f117daeeb96ac3f3a23c76762
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcba7a32f7739145866a18685115ba37f71791391f1c3aa8d8f3b7cba5b7c6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33ee79cde92f8b5d99d9e157b812e43cb0a7f5b3fcde2764eb57cb3b1b6e0816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6838bcd5d667df95a4af2d5dd25aabdb01383ed9b5c895cda1351f7df9aa7d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74a0ae0b35284025a45dfbd14eada03c1f042a9d38e59e711bb9689fb1905b95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d1b01c5b5b13835c7909cd39a3b798937b9592ac5d51f8e36ed1806e4bcd5fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d271385a6d2a3f01ebff2eec7f4040cc426ddeede87ffce01852c0811f56c036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b19ed437ed11f467c3266ccccb9e3171608fe85ac632b2ef7eaeb2c882192c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1306bcb9ac169aaf0f7d8b376661e1820b757a63dd20e66c554dd76735d7d9e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf168173d225effee84774bd5b237ee3bb77a846b30c7612768f1ab10aed9416
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc00ba5f6bcf9753940bcee30103d23800f37e6e3cd8a541512373e72875cc4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20cea4246b0fc04b13d608182acc309fdcde4c2f7908eacbf868251b936a2ab5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aea1625732faf5afdeea3f595f93a0fcf01615a9a83e1c748e459517957e58af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56735497a3736794133c4cf495919beb30f82991cd794bb7734a5061cefabbf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27565407ca7cd4b4bffd9c58745779b2003d3cb35bc3d86e48bd8bc8040ec233
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69be12a0b0f70eb2bd4048da4cc6da0ab1313fc73a85b58b97b75412d5c81f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b8bafd1dbb8038ba0e320cc3d0082fe484b99671dee131db67e09ba2188bedb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb16bbde0f7756faeb595765d9f123fe5bb9b6a185946dad7c541e19b57b390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f77c3cbc43aea2f46a6c35ae9b9843e2a47acb9d25061ab2c304d745a747f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 663991b20d31d4453e65e5061c37b025736c8a4d0f9621ab6ab22590447b4076
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d12653879d5e347720e6df7cfb981c34c3a98969963998608f83b5fde6776752
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31674daac44378858128f7fc95801f84f501cd342c9b1e380e858ab574152519
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84fcd0f029d66de6cbe44fdec95008fb8cb03edd0ce88ece1deabbbec6f60614
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cb1111213ce15d870a798a346ab2f337a46df54019e08fe94446b233be49753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 119b006356fe3be8424f42162313d387e2025055f6fefb8743e30545dab87d3b
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/544-101-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/544-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2208-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-107-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-71-0x0000000003D90000-0x0000000003D91000-memory.dmp

            memory/2208-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-75-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-12-0x00000000012B0000-0x00000000012B1000-memory.dmp

            memory/2208-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2208-11-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

            memory/3980-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3980-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3980-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3980-72-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3980-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/3980-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3980-27-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3980-0-0x0000000000400000-0x000000000044E000-memory.dmp