Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:47

General

  • Target
    jaffacakes118_Fifth Gear - S17E05.exe
  • Size 287KB
  • Sample260910-c9ys2avcje
  • SHA256 6dcf224f48804ab6bbf245dcaa38c5a8b4fd0a7c188acb6fae7ed52fbd3f22af
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3276
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Fifth Gear - S17E05.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Fifth Gear - S17E05.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Fifth Gear - S17E05.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Fifth Gear - S17E05.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:440
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3420
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:3096
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 528
                  7⤵
                  • Program crash
                  PID:2376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
      1⤵
        PID:1768

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 6dcf224f48804ab6bbf245dcaa38c5a8b4fd0a7c188acb6fae7ed52fbd3f22af
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 ff2605c9525dbbcbc2490628551c058ba86549742e28c25a69c880b22d8528ec
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 2b62e17ac57c398e5491f3a201d6e5af68987e9ff80dc7f17a69e6741276f70c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27565407ca7cd4b4bffd9c58745779b2003d3cb35bc3d86e48bd8bc8040ec233
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e80b0f4acc590c41689cfdc636c5507808f31e5f79ab6dea92d64b4edada18d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e44231f8277f9ef89f280fbfe8fb6b9dba36baba1201659a84faf022f23568d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20cea4246b0fc04b13d608182acc309fdcde4c2f7908eacbf868251b936a2ab5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69be12a0b0f70eb2bd4048da4cc6da0ab1313fc73a85b58b97b75412d5c81f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 771a7a21c6670db435a24a44408c7e021a335bc9816ce39f1122dbd2ebac61c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b19ed437ed11f467c3266ccccb9e3171608fe85ac632b2ef7eaeb2c882192c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c31b84580cbb41eed25ffec2daa76fa2170bcda26819fb066ed5cd373d0c35e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2162224e3bb2639c88a4dd38ac17766c3de2bef6c88e782e58ac80ec431951c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da28f1b9cdfe770e6612fca9cfdb76d164d0bf1f117daeeb96ac3f3a23c76762
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f77c3cbc43aea2f46a6c35ae9b9843e2a47acb9d25061ab2c304d745a747f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d71ef86c968248d41076b0350e20743157bc19bb284ce1494e1dad0279cb7350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 706da954a448d94ec44b4b114c6f029b2398067ed989c7afd4e43023b89add6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb16bbde0f7756faeb595765d9f123fe5bb9b6a185946dad7c541e19b57b390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d1b01c5b5b13835c7909cd39a3b798937b9592ac5d51f8e36ed1806e4bcd5fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d271385a6d2a3f01ebff2eec7f4040cc426ddeede87ffce01852c0811f56c036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27cb9c3c2481999c5920d18af035024f0622b7440b7a793eccbbae640f932b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eec07313223304a82418985adeb89d32d615f2e105699cdb1558b5cc5ea81554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aea1625732faf5afdeea3f595f93a0fcf01615a9a83e1c748e459517957e58af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b8bafd1dbb8038ba0e320cc3d0082fe484b99671dee131db67e09ba2188bedb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66613d86e0f944594010edee41c4f5cb22464c221cd291c8b6f3d55729161bc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf168173d225effee84774bd5b237ee3bb77a846b30c7612768f1ab10aed9416
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a5aa0c3aaa3d695f2db0977d957ad9261d3903482667ed4ed4aeed9a658a983
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcba7a32f7739145866a18685115ba37f71791391f1c3aa8d8f3b7cba5b7c6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 663991b20d31d4453e65e5061c37b025736c8a4d0f9621ab6ab22590447b4076
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b7cc933e9285a9615ff21e6831c5dc981557724eb0f8a975861a4a33103aa5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8244d68b37bf02386b0d3c1e6721e94936b13e158058f79dce81993525372b53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab844ef832c0ae6664595b39f5aa9360b3aa5d3f7a2f36768d09372d161b38d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f595e6ca03f04ec1a93add4795214c307c6b455af6fc5f0ea1b71b6b1c014320
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56735497a3736794133c4cf495919beb30f82991cd794bb7734a5061cefabbf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 226c8582742e331d84d6188dcf65e8402e1ef67073510ed83b88901335ed8adf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc00ba5f6bcf9753940bcee30103d23800f37e6e3cd8a541512373e72875cc4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33ee79cde92f8b5d99d9e157b812e43cb0a7f5b3fcde2764eb57cb3b1b6e0816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b237aa3045a20c6522564f1dc0fa77fa00813bb69550ed3a19088a43b6d1fbfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d12653879d5e347720e6df7cfb981c34c3a98969963998608f83b5fde6776752
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ea1783b9fe774337956f592b38a70c8a36f7b8ce8b313ad93e704836e55d3a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8071d470c0933798a7d3826503b2a49cb4ee9e397af318742603d723fca0178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba3a2e086428b75bd9cf9eeb3a8b77b376bc342f2f88dd542d27966eb668f2da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b537274f9b04e3cb2cab652461aee32e47e232cc74d230a60a2e141a69695695
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b793199d6dd6d6065e330140395148bd02dea9b9738a11b14c4b23ba526985aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6838bcd5d667df95a4af2d5dd25aabdb01383ed9b5c895cda1351f7df9aa7d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c025a32d2250242fcf1c44473408497ac03731c3264e05d11d8f7fe6ee6c2b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31674daac44378858128f7fc95801f84f501cd342c9b1e380e858ab574152519
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d0a87054406e2e96a505bce6936cc8e4fc45cc2e97e3020cf794086ff77b09d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c00372e04b9076a028b57db15fe9ee514eaa9c399d83894e5f99db4f82cebd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 525f77d616d6ce80ca583cb535741be165e6c3af95be80039b7d09b9debc7545
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5d8b80925018eb16fea2bb53f68d32566e62127ee758228b4e66f28b63406e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74a0ae0b35284025a45dfbd14eada03c1f042a9d38e59e711bb9689fb1905b95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc700e7cb027d45e7e3ec1831f0eef9efef040e02b1a2f63eda5434207080b7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84fcd0f029d66de6cbe44fdec95008fb8cb03edd0ce88ece1deabbbec6f60614
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c32c79f26cbea8a578a9b34b9369624a1ce7e72785dd91dcc5f5d0313203287a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d7f46c8b63a202b7aa3e30820a35732024c2411f6f23a3f01910086efb6c245
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe64e2d7c477f7f3bc87ce3230122e93829f15530b1a4464f901c7b59eb896f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb2e30272dc1059488d81d24b36f13ec4ce63a10184ccc14479f6b4a0539dd66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52586907d9e914f13d39d66f99eedf67c1846057e7c513527221df69c1a35430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cb1111213ce15d870a798a346ab2f337a46df54019e08fe94446b233be49753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1cc33b96af6e7cd5f8eb02c52b65b0448014dcff4820842b32702e5cb86fb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9acc0667bd0fb254089de06f6b175e564acc5324cc24fbbc581ea02864ce3f4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d9ddee2fc5352f0ee639cadcddbd76c2699ea024fce4becf90c31d459f681e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a68467c0b8b60f2b7b7cb8be1fb03c2945a74417e248efb4bd9528b81f4d3171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89011347646188df199a1be90a0622068a5098ca549a99e9f3e30bc67ef718dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1306bcb9ac169aaf0f7d8b376661e1820b757a63dd20e66c554dd76735d7d9e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ca8be151d41064c9be0b431372685a4266a7967379d2435e372a0dec94fc3a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d68e456dde01305f651a02bdbcd78f83022f026ed8be3feedcba70772fcfd05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16e5e1b8c9e2e158ea7a7a226621d29f5fa7981ec4bb93cd991c3a8fbfd94542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b240b11969fcff72c59f4248686e50b5a0d463d93e743cc919caaeeff09358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 045a9bf19ff15dea6f39dcdb105dc545a66cbfbd380bb2c036464ffdbffa43eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a58acff5aa88061c1a23876e81b8bb78b379492df9845bac3fc1128bb1b4bcab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 119b006356fe3be8424f42162313d387e2025055f6fefb8743e30545dab87d3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7201f64a1415ad5636de1bf93ed8066c3894af1249f3bca1df8ae31bb97cfdde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24232107fdf48440746ce1fc338ce7ceb8b47a0b24224a71a2b237cbee09214c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b801babd97f933b38725aec3d6e879d9e27237d374bce6811365d4a9bbecdb6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0949bce1f4ea86bb4a444b7fac84429da7436d789706459f4df3c82f21333cb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7007d3bd6eb4f8e33c24bdb801a09f6b710306595165de4826ae41c754413e5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0864b8cd603c4e5f573f11e35310bcbdc8e696e3631d1bdf0ded51c8a133427f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4a9d6fd0d0cf996b363210f8b396ed00156011fbc1f1b1f21cae5759159ed17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55531dbf80c9c0169102633dd4c214d2b6de8609b651249098928d4f87701445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75d636de91ca1d4a4bcacb1736b321c5419dc25db36c94082f49a265df94b03b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 755fb4abcea0318fefeb1244048dd9b883325b6a1fe3d05ca7ef40f49edf5309
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da25f2bbac480ea235fbb1a7513320534694e0cbe5e8563e75c3ddd2ead62099
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1cec891e38b989529667e9fe9521c283c5bda0da76fd5e534bdcd68d0e9653
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57dc6076a46911d0a5ff19b95c66cce86a4726a05357ba94dd5b542ebb1cc944
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ab64d3ac56e949da492396ffb1316de23e03aac49642380f32b4f571d56749d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d3d7c0e1ef3bdd0a0eeb4a19fb260c05bafea3a97d93b14a09306853275a5f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad95e70f09c9ce031ab969272c53dcb5f63772eae77d6934d0fa5be0214ce567
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ccddd4ffa0d4ccbb1452f532938990403ed5daecccd30a16ef05c114680cc10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b8b787bacbf28464947edeeb956e71cd6f0018cce4399d3717da1d4b2e0a8e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14daba965c0833daa9cd2d144567f890338105fba2b9db7eb13d51ccc972af75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f26b699d93f1ebf95f9492522cd721aa0d70b4163b678b4d7fe958133b116a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3869535ed0f2f4cb27edd8445cfded79cee65e64fc9f46e2765f3c4352909292
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c08c969425d2910ab4b797e4183834f2e0c95728cae25a67b377e10f729b2ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ecfe035b505ab9f2356ab5c24a94b095fb3a1a7e61bbc20584fefd08a318bac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed82279029c2b5e5f785d75c14e5bcf199117a57947e107268af8d5329bf2fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88e28fc019c2be265f4eb5ed3cb9f1ee44a1d80e227e2bdef5eda2b4de36ecd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 415c80fc94993e208256a9c16256430d4c27018c2e1e2dba98f04b30ec422d15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de9c58eeb915d0dc985a51c8065f3be14a94f9893345fa6df8c8d3aca75145e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 021342b9fccda067e61e6ef8f233b9c4726ef3d84bdfcefe8e43cccce8884c90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d20f9825031db3d37e15417ddcd376de0320da665f886883fd5cdbf722a5ea52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4693af77cc5aa56ab735e76ee0a59f2ffd4d7bb472b7322a5cce6a03ec3214f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65335889856b48bd2e9526482695f554872473d35d1f9405808855bbc36dc4e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d21d68a2402b9b6d4699e6c9d88dbc79b6d2f4b425a28766f2877b355fecd8b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8336bbae62e09b754aa4b8f8a3bb3f2fc57da495d83d082e2ca2caa502962425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f66a4880f3147900afcde2e3df3217a31c6555023c8149dd7c939dbd3df8403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6188fc7a7e8990598c945c1704d714ec41ef37f404011e6cc9eee682b58bf81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10ea0c91faf4592314850340be90fc4d5fce5cfb76637a311e2d5294f0db9e87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd960405979bb521371f51866b5c7d3e3a56dd9b5bfbff8da39798862d22e7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73ae161a49494595e2645a738f82e1db49e12f5292e177874938de9e53df29d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e9dca0e6988058ebd12a4c6580984b112e93d13d6541f4b5176ca895fde90a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b91c1ce03783c32fbfe84737af6ef147c06ec02bf625acd143397020679d6ea3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a9f0d242d1f11c23c657f00e02f349a182a3110bf960530d49f79fa5b97762a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0218f2b4c63c63e5ccb0c33f18e5afc2adcca32dd4a3ee2bff0fc2e633d8da5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7a819e802d447fe5ebd30557257d5e23a87529d970e9c888c602e0853ce3e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5a05cda97632a917ec76f1ccf8de377afdbdf5b4db52c8f3527ca9ffb1fedb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67848b70da6f652cf219668aa9c54571972d7e67bc38e5d1cdf818340190cf0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc3260e3ceb1f0b01fe520a640241fe019d76407906e8970f00db092e63f739b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab621719317a49b2ad4a61829b584c0a86173f8c79b730541c735c8ca33eab69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3806e8780ff83acc7ece8c58f3dd5ec79006a3764ab64bed34ed24c64ae4fd57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b6bacbfcb5f0c0398496e35a00c31fea7f46c2db27b3d68891e49fcedb38a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a8e288b15ef80c3ddbc407460c4f1ac55b2a93a68d30dafe89f8f8472d74d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fbd7a1a2453a2b8c0a83096258ff0da4b1c1cdea850deca43deab9a0beede27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12a8f2f2fc596f2ebca83ccf3eddb3203441a33898a67bdf94a1e5e5640937bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae317b5fc8e562c51b6303316b0b5724364bcb2904fc42cd2c2ae541b966d027
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f91ff6394faa46982619904664c10df1fd002e140f78c8a0069b4ed869bfbce5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 126d722cd421b97735a2dbd913f1d8c20f4ff3cce6afff43b2289be2958fe60f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79a3fa56ae5f72f6d77d357ee3d8f9673a90cc2ff5d5952bc0a40eeeafd9b753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 169f5ffd59fcdb290a1773c5e1826e8e3a0d2c941ff709490c78c71fc0d66b0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b14baa6aa086638e2554df574989e6abcd4ed876b3f622bc730d7dff940cf067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0217a7e720efcdb92b7a65e41621c451ae8289373d654ffc8074e6b5e09bd0cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f17f920809f71ca015e4104e64ddba58adb28255dd68748217112f6ed4136c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f8a0e246c60be1c33d4b4d424b87f391d9457ce0bc61046e8684efc09a33c9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c818dd7cc073afe4321239130961242a4f21cef67e154391b01b1ad6758cbdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b5aea9a6c84ce7aa3bc92833d5672523b455947c36cba2464afb9b9aa800426
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38d1398a29383d8871d7a73d34e2f07299e6f91be27eec23cf0d17d544e6d368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cab9c4b6e338c672dfbd5d069866de00316ddda505808ecbce75719ae228a17a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e05f384150594a6ff6db94455c515c927ba2878eac883c30d81380634eacd6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 573bbb98641c1e6bec0e5429653abd54df069c7da1b93b7785ab98a69fdb9c36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 677aaf9caa57da4ee283e8faed45e7240592168d565590359d971b51076fd206
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76d7af1dbb6c1680ea6b9ecaea660bfad148880dfc889d156bd20d106bd40d70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32d026983dc0bdfc37e0c69e4dd9ec10b6d71eb750bc1596b338b597e8da42f0
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/440-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-12-0x0000000000D20000-0x0000000000D21000-memory.dmp

            memory/440-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-108-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/440-71-0x0000000003E40000-0x0000000003E41000-memory.dmp

            memory/440-11-0x0000000000C60000-0x0000000000C61000-memory.dmp

            memory/3096-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3096-103-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-6-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/4348-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4348-27-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4348-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4348-1-0x0000000000400000-0x000000000044E000-memory.dmp