Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:36

General

  • Target
    jaffacakes118_Joboshare CD Burner 2.0.4.exe
  • Size 287KB
  • Sample260910-d596yaen6v
  • SHA256 86cd8d1d9caf45f78331c998fe734d0db712a738f30284e18618ac0d85890be4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3164
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Joboshare CD Burner 2.0.4.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Joboshare CD Burner 2.0.4.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Joboshare CD Burner 2.0.4.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Joboshare CD Burner 2.0.4.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2636
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4156
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 532
                  7⤵
                  • Program crash
                  PID:3724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4156 -ip 4156
      1⤵
        PID:1596

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 86cd8d1d9caf45f78331c998fe734d0db712a738f30284e18618ac0d85890be4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 e18f419a8d93be88dc159fb13b08f6516a9d7a065b7004c95694833e129a5b8c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 b0afdc3387db095217818caefd59d8e359d7da499f523332927390e189fa147e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5487b98968dea83ab3a1143acada64c799e97d519d47b0f230871bb2076377cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f7a9305b98f161819f9d356a7029b11f44c45dc18eecf7669cd5d880d7c1a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b776823235e90842cca1a01306cb91edb34fa7109ae6b8b87313779e5d6b3bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33f48e9b99b58c69d3c8e6c23742524ea618567f093079a2ef96982fd7a15f70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04c48c9ca62908d6001f6abb8e78873fb2b8e81d8768d9fac3e831265deaadaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f41108975f3c93180131872af537ec83e88071b3fa6bddfb0b29cc363d6585b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88a3c70e6e8dd6e34fba4955bac61df5a70f8b763f5fd314eb51ddd595963c28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ce0e30f39149f2e2f4034f458a69f2f8d548f17d08077dc0867d63ff872916f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb87c5c585914fb9d895f1f23d648aa01d2f2d9f03489a8b914b6f1c5f6afae0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 206fdbde9fb21521ccb986fc479a0f8e6c1a9c67e0f1e5708afa0b9d9906e2c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a993df1143c74ca40fc59dd7e38453e25625e4bddea9e741bfb2e45377ed68c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1170ec9b9aa6f7768855faf6abf10e84e664dda50092959e590815f083085f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30db7d35b35252dbc9a877e03ff3b0d36dbffe71042dd790877bb6cc97629b5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce452f32b1244cae2d201b8f25d01396671df47630de656ed3704bcb0e7ba6a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 330189cbab7d8fb1cd44666926d8b2f58e28cbcd8637871884128c87f4cc530f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08b2122f0e6dab959ab0c3a9da01613df9507d9a555c7646e12964b43789fa4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a086392a47ae2459eec9cf6fcab39f6b10cc06b4da2238c808eb3e305757e0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a871c931180bac126fba04b1f455b0bd668d28faa173b1b203c9568d529359b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 473ba9fe63c1d69c023b432a4f37d0101eb81712590d438162a8c43ce746c519
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 276acae68150d39b5c4b8ce8acd510bc30e48961308e7565fa551823e515e57e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb58417fdcdb1658634129da2c6d97c3f165c90863d527ac6dda765fcf055310
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02fba1047febcb188fc62b74974a2c856e2a4e899b5493bf25cb87540d820588
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22fb8740310bf00bced429f33ab484d738aff1b256c0c5e6c9744cf95369df3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25b270cd07e3e50fa6bae60e7cc5ae43fef9d9354983eb97e3f8d839928aa492
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd7a3f771e3ded0b285ff027e29503068761b488dbe9cdb22e63bb101676bda8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869e9137e785a751b5432044120739f810d5c1e9cfb4843cb3546393bc29fb68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b1e712504db5cb385a8146bceae156d49af0bf26051a543720b2b2cab8d4af0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca6eaece292da97e222271f888972a508d7ef2bb68f1805981e2a04e5c77627
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1023ec0c42eaf5a864aa0dd22eb90ff0340c4123c62d07a685f2d6191e5f8275
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edba7237c0c2e62710ce0b894a9d7b557252679e87178d0804ad04831e3b9382
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ea43458f9ba54c3afdb0ec32462098fa0980449b94929c9763158c03ee7974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c434a324f5f392e727828a889c114fbac760c4d9d9f950e72eacbf63f808c855
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94458e5fe7225ea91982d9528a340dad7af454a0b9441d617f1f87cce3cfbb46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79189c900c9e1b1aa3e3df87fdc1fa7c56d680bb0e5b5b18cfaab84808786fbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34403b25b87bdd3aef283ff49bd2e11bd406da28da38ff1b3a6656e7b747f26a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c27db5a8705577439d6295f9c20cdaf59ab912fecc691b33b07f27295be480d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6380334c02ea909662dc424406c7fc1413682940b7331b3ec1cb2c15bf20feb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21302dccdd4a104dc292fc0e06bddd30e215c527e39ea5ec099e37e11c28fb90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3556404ce52945f202ecd5c61f18c9bc92b48df824405838b617bd977461abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c3aa354cc22467f6dcdbc7570404af239dc7287e98fca7cd8ea77bb411c7f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae95de7eef4858d83a4394a858bdd4d78b805f611d2f88a15d1312f95082d86e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be0cf2156490cffcb4b50d7bc9da4d59fa08a7368104425efdd886fe4b20203e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b77da013e373e0320439b6aa2ac856130b70cc9c1791a03c41f7a1d249ebd417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d22117b760f8161eeb49f104879415d4317d7a0463bca9cc51444f4d3d3e54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06da4f52e0215d32aff8d39d61213d669c86458613726b14def3f47f00bc8198
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 540e547cdf6bd4195255004910a23dab61b78b196e08ed0ae5e84185267aa966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b27c53530a25df529264688ab6e60c2e50c37cb161ccf8932cfc8e48fbd093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3e946d1dc25b8a2fffcaf809fc91f445db266b683aaa4c483252bf26bce674e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d0e657ff033df53a993f69f303ba1692f56429cdd45469fa0049c0426eec06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3843d507e844c5c5fa6bfa0c60209b0d2b4fa3bb55328464382f437d82c92372
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 955cda7d86937313f49f442a436fce6483b781d28d41909aaab022d17d3c8929
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cb39ec395677fce4ba3cea9a40c5e8982cb4d475e3bd0b71967160c38b34da1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e102da072fc8904adb8b7386a86807492b0ec5508b225e9fe3235e7d5dd525fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f52279945f55d1ce0440d17e545d2ec3ad0e8c85b19a47b17e9f1abeefc0134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c822eec51653fb26e52af104b658033d276ad06e52d2a8d3bee16ac373fa5c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66dc088a9b1a07378a66523d6cc718bd5640537774b4f9e9feaf560b0279ff87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce7e5c513f552db41fb0e2e3c980f6dc367565001f0fb1a13c754e53eb3cb153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d334b96a0b58ba838fda0533b81dcbe06d900f870f6c157e8d2c360117e6b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1248b5d9c67e20e7d0ec093fa55edeffd4876c9a721ac347ad1a5d79bd1af3a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc8c381b3aadd0d2ca05f68b494635669f11a00f7a8d4185f564bf2480650c4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63d2370b38739f650dba68cf723d97feee5fedf43f30652e30bb3077c86ca885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1bd4d5bd9fa7b313b6733f415f37ee9a8127c0bcd3c75d2e508a0d8d15ded43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 651a8440b275a7c87b0abbee55d37098ceebb2b26c737d7dab634f52277096c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eecdcc79be187be7e7fde8e98fc52be9807d6535edc28069db128c56cfb373ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3274e5a6fe12e9a0b9f3191554d57c4f1c6c0a48a64fb832417ec158503366d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4daf4898c391bf6656e07130645760af5855c3faee86f88a1c4151d4456d86fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f26120e6acccf51a91e6db56fb13c856269ae644534bf10b967fcbc2b9139e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76882558bcadde43d1c7f5816acefb822d194fa14ac139330ae4bf828defb631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7a9099f1d2349e6a6fb11d348b8edee25a4e977464cebdfbcaea415802259c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38aa7ffa0eb2d9b69069c81baf998ba95d7151fa91e20f68b73ead5f95c0cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a42d88806ae2bd0081861c578e21d5d6e8e0e602028874e5159d960b1bf20d45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cadd8254f2bbeb754f3d2fe3ffce78840aa733e855a0b644eb06d93cefa0f29d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cbb8a2cd3d16d8773e4a6bbe7f35e921578d5627875e0bd05624c0a5304dcd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ec5f2a5454e6dcfc91d31e68a9dad3175617e7df586d81737be030888244795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30b041698b65e20054c38818495025b0467e4ddc1350396c4abefaf1b1ef1030
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc66df6ea61f1aec129d5492c5384c647aff6384fe2cb757d4f068b12693ca57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec845033657ad522ee2aa5dcb199bc7c6b6b922f762a7f258959a9ff2f42d81c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67b70eb90bf58aeb826bfe4a5276d04225210714773e35e7250ebcfd15e84641
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 299bcdd505024afe43063db1868f6071ab985132b9205b5020cca8547e99b644
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfacdeb44caaee1c7cb9bb6184b89fb73eaa57a9ce1fde5058c65ede3135d5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 051c2067fa8657d6838edf8c5e6aaea51f4ccd1f2c02a5d067aef25e61e5255d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2cff589bca46523e22c6839693194fe0edc1cb9067493c578442787084ee329
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1687b94dfb090b01a4b1e873493da85f124d51afba5bc126a811617a8c225c1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebaaa5ad54bb57b8471318dd62d533bc93fa96ced6292a5fb2448378c9caea01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dedee78d4e37d82eac96a8ce4cd705d089c07ba0b958d229df53b3008a03e166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83983e3068ae502137b330f6923c57bcba30fd92987223b90dced339686c1797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c484589eed0148b709e9ccc805a2d33a0bdb790c737ddbc83d3bd89a94f8da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74d24a06a20eaab3a717da60e0ce21f54dc0ab42276e05a730113f500ef87bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f43a5106de97a4d54687eadab7fdb7615fe1289780209ba01603f0645fc380f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a6735b5916534ea15e46a200cb2746bbe6b13ded2d655a3ed5a3abf124757e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1204e147deb846960eec8ee42b7637138edea3ddd20b0186802bf036418f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 094a99a83b8e2c6da567e64d4972043a09bbd75ad18b4389701fed2ba0ac5f89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7da51eb0036df6ab16951acd082168db6608c3b2d31ac5dfb6ccbcc96c7bfd2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10312d1f4ace7e44a83abb2301fb2d9667480bb50a7bb87ad78a301aca69fa18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a25c32e10774bd6033104413cf344a1abe86064f06e8e2b9b06bddfde1cf07da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f0b42224f8431c0d2f98209bf48ca192750bf743ca7be6c716f6ec962ee6d8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e3a344d56d22de032b4b1d8dec95113ecc1c3f9d4bdbecd3d18ad081d927b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6bba96a3094488073da5645142da7a11bc2b3381e3f57313fda879d1417dd04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d846d508582796df289b12ee713a41df637005512b172353b7d2695b8a376b21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d853d12b3f877c08273f3a07d5c0716dbb063ed8e23956e07c880d1c4b3c7f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 135e284b00b8db8d372bd189b39665df26eeec75779265de9cdfda8dc61722bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e036d6a6acd54fbaf8e3693738e6a836a02c238ee86cb325e4ed58c85bdd4210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5425523a48a196ab5bcea3e3f338d022519ca0b96f0ef1cc6eb245d7e076010
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef43450390157ff040782a8d06c02735341e68e17b200beffc569d489e2a216b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 727a20718d0eb55178970fbeb8a7700e3adf24e1a029ac59c61222827fa56452
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 622d8c17e5fc13b36fb63fd27670075394a1a7a38d6b94f81e81b1dd07a74c5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9120780ea5f615577d9379adb1573ffbcc5e57a34d1dc3c7ee6095476f7db4a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61754cc036f4056634a807db79c3ec9dc768b89c166c903320861cd4f2c2855b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb71e228b8b2f36dedd6daf41765a88a191f6ea2dff23ad25a094ead43856af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccbbfa3a7785bfc2d09471d0068c703dc8ad7cc214cb6d846853e6bfa1af0ffd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 347f37a63a99569c4522e4b4a86b8e8cd00c52b16925e226003c92c4a7813242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a344daa9e042bd8d7e5af64acfaf41d8f91f2ff9d72e0fb3a8f6f6bb86247580
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2babbf079dd5d463086fae4d17786401916c289786269cf544fda89a5ecefa58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1b84d0e64d98a7fdfdb9a55759c56ef224965b21f51e31e4ea77bf89f2ddc98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba19574490b5f59f1bc1f5dc6bab8fc3bf3c754ac86c0bb2db2539f1a1c94e4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40a91f74f3bcb060862c1dc5142170968229081abb1497c34ca4a40ae0de81f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32a250cb1e59a195190e9d555c87befb4b72e6eb3b581882d259be327c4c89f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2725c7681f5695654cc81a6e9102afac94078aad004b5c17406a90e9c8ed732f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aec5d0916ec1a3272939baf48cd1c4c8f546b2ab98b62c3b58d1d96dd9cef957
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 469fabdfde13e42151202790266588509524171360581866d088107379fc8968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c43dff3de871934cc74d9820285951c80fc216b326317a2b804fc0f69a9fe231
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1562a94def8474bd292604868ace2f74c4f702c8e55e0be3f395f8217cd418
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe5c0413ccfa4e9438bd7b660ba9cc3e622721a795d5882f0c02f6d7c6bbaa6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d11ae5d6f09a0a21fa984345c0454abd62990177c73d22d6072b644e4d72f91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a297ef447208dec8e81fb615fbd00f8141d9f1e87c2758fa7f7b66791c4bec4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c59d7b038cfd9f46304e9d77f060da79d4da11412a04487234d8db6ac312e06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d6a5ccb5364636b3f34345c4a3ede978fea5cc5e11aa031d4e27fc93c0de408
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7263e915bbd8f95569741f04c54e8b6e468777ceba8ddefb7e2a8bb98c91eeee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 804b95b8a7382c2d208f1dbf598aba4e18c6997201a3fd9d21f5007d5a15ff9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61bf21214e623783d57d668cb94c516286d1b37d22018879b0e8fd0d76338d45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dd25026c5cbde8afefb2daea0012f84a16962ece29d5dca36c8306b77e51efb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceecb593c6efb0b400c04bbc4989d1d75a913234c86bce90af351b133d5ab928
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2533a8b852a7bd2aef04b1dac1a3f16ed53f9cef25b2dd79a1648dd2f165a8f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f133c10423addbec487aae6095fb3deb6f0d94d84b00efeb67694f1f6a9de98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c6eea24834bc32a81fc553460a65677c33e06d961c760bcd9850dc22960b55b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 224c859a56ebe6efa5f1512c85c8f020f51b6bb799e821683d730acba9c53c6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66fbff213cbba61508e74e6beba9adadb6a3b4bcb309fc6d89333312b34a3833
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eacbef578bd64b737e7b6f7aacd74ef409913ebd79f3d8f1c8d9ff78ad29643
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5082622ea7aea02952e2e61dfdabcdd8b901cbacceab0305c5fca40b865242f3
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/3180-6-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/3180-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3180-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3180-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3180-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3180-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3180-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3180-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3180-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3964-12-0x0000000000E00000-0x0000000000E01000-memory.dmp

            memory/3964-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-71-0x0000000003F30000-0x0000000003F31000-memory.dmp

            memory/3964-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-108-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3964-11-0x0000000000D40000-0x0000000000D41000-memory.dmp

            memory/4156-103-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4156-102-0x0000000000400000-0x000000000044E000-memory.dmp