Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:39

General

  • Target
    jaffacakes118_Blogger Template Solipsus.exe
  • Size 287KB
  • Sample260910-d7lalaen9w
  • SHA256 66793ccbb889ce1b437fff71f9111e34ea039c441ab45f1988cdf657b3b87294
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3248
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Solipsus.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Solipsus.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Solipsus.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Solipsus.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2040
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5332
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4400
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 532
                  7⤵
                  • Program crash
                  PID:4732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
      1⤵
        PID:1544

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 66793ccbb889ce1b437fff71f9111e34ea039c441ab45f1988cdf657b3b87294
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d846d508582796df289b12ee713a41df637005512b172353b7d2695b8a376b21
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 2c4f18f82c2425b751386eb3629d6c9c057ec7e8758fe2dca2177e4b1cd34c05
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03899221fbafb6fbb4c96927972ef180cd7f45297668eb6c0e34218e1089c669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dde1a9273b077670cd3a48dd98c6e868c56b9293c5921b948a7fcc0420519130
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d08136c5ec8791269620c9dca2b2f87d22b8e6c48f717c6ae0f893bb931187a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00ed4c4795c1b717e37cc96a271eef2dea41817b2ef21ba96cbae7c3fa2ce6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e04185ee6e243ad3dfbf1e031951b3c5dbdcc010b4ca2ee749208603a1aa16af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b65c4278ab238c0b0852e3459654a8e67eb45a5d12c28ac32a4b6f27f7f3d66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45b578a81a84da2bedeb5540d213be52820bc4ded3d9c901c6f7a5f5b56687c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7f4c5f4416968ed9742689cf1fb362be8d50076c26a761a174579a838b49aaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5082622ea7aea02952e2e61dfdabcdd8b901cbacceab0305c5fca40b865242f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eacbef578bd64b737e7b6f7aacd74ef409913ebd79f3d8f1c8d9ff78ad29643
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e22ea3c86f2f8c84f39a495c6a47005cac75415cb01b44d21907bf4e31dff622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aab26fc3dc93e82190878f5b1f1084c8ab7cff3c45a772c1d13a35b5658e36e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7ff7d33e4fd02db823124b8a6b0a7a44b99d6acddde3f45597ef60f344575fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa31c5d81391377d5b63cf5afbf9a80f081a0d22737e3275ddd82eacfbcaa7c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a428953492bf66d3e1bfd3ba8f31d75143e0016bf823d02b3ac88f41a60ef26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edabc4e1adac7a8d1d1f4f2b93a02a60944234dc7c8d6617feba9a2769b856d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d64dcd15f53afbc632a0bc5f697056b6aaae818ea4acdcd4467b52c6bb98b24a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6180a25fe02652883a5a76ba37b565213116abb31e5e5784592ecb8cccff9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84899977773852b794d8566c2fa79580bd64ad027d1b940c625a1ce1a06f1b95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2497092589e033c1c22792c6f7a63c4a10628d4b7d68e060f41281c38aa8835a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a0355d1460bd934179c2d29f3c3d1096fe1fc6f12ab1b58194d5b46f0f618c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6af4c472ea774c2d56c339bf9b2196edf24c1fa5a931a463becd520c7af75f85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 705a09bb1a0f697b117ec93f4a2cdd6344df443acad2efbf3cac1857c5fb29c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8510af8315121087d7eae1eece1dd41ae43813d272acc09284d5593f262eb6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c05d146551181f61213e3721c70545fb766d3d816a0c21b5ac77889ad1ad75f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcf230894c87f2d8943ef2625ca5632b294508f79986a4939ea7befcdf67cc22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea51c6790a78193b2f9bd87d529e530c0750e5b075387c43ce7aa94b4aebd28b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052546198c5e98c20f09f0ac498a62ee2142d5600bce74b228e88f350465c87b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5c6ad5232ab331e048b34638fa1a595a9b439bb6c38442c4bb11d4558f9c44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b86e7327951e3e2412b6fe668d1113a12abd930f5eed8f8fec2d0bf4db88e230
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d0aad9761ccac03e8ad23e4bbdfd4fba3f879250d0d519afa5e031256baec4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e79578a0fe0584e9855f75fad21e0f5b34f368f8bcdfc9d849b44dc8aa01b5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff634bc0fdb80b76adf6b9af9cf8cd36860c1406637c0be3bb4c6b88c9ead55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb6610bd7a2fb14bc5fd26d920d6799cda1b472aa4e41edc9bc20e3b63f3d06f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f30f07a7fd279de89c6a5dda6b9c726bc99a2fffe228ef551a748f371b820ab6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af64f4a3e053492d592c2ddf861e0f9bf882b280a5f7507c27bec1c7667d41d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac2893ae50cf71a9a8b0b959a95a8b35de8d76a1635498fa213f84e4ee40e9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72344350609e63b5986d4719ed2af585dfc62c2fb095557e13eb88992cd53aa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363ee0e077cdf819bd86d9d2ecbb404eabbd15e836c5965415db271a1c3b06b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b64ec6cb8441cf6d692d87d79f2d59bae5f74499941f853e45dab9ff712f895
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e49f833e28ed520c375739f737e83db807fc4487e5d28743175ec460a88871d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c34ffc5d93a2ca9e21dbbbbc3421d024c8429b4404ac9c2b8231376bebb43c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40facfce67e0dae31ec6d832d03ad61629593620c6a8b4fed738409cb9ee0672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7cc0400a89e8ec7b2d7fa5a4728a17874336b62ef720120ba3489048c815fe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 183180608fd70094e55916efb32b6574cc5384250fa462a8fe38831d9ce6b134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c07f29a3241d18812682e4ae7b1ddfb23151c7a4e5c20127e41231ad3c27ee7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a804b3bf12669af260d933363d438bfe3c369553c4686e5efcd5b37dfc619d81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87de3c08e293ccf3a6a68204a6df277ea432e8d9bd0148b536610d7997fbf398
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a48c447d218099dd23792dafb5f7640ac198b009cb285517d04ec6a12104e2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83698e3bc628ab17dd10075ba3f10427fabd27cee9f68e41565f9792ea2e8db5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfff2967d1464bdab7b04d895636048f8746b603eb3086c273e575363c8c409f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3f925ee6e32700df69d7c0ab58642b100b973d2c6761ac6e8683152b80992b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99193b8bd10a4681e5d44d3c80662bbd2861b698c52ff02fd4d1b65152f506ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaec1461bd841db56f990836487acf032483d76c98704e43c9461395bcdcef65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d63e4fb29351d5044eb85e09cdf9b1356443b399883b09be84fb3d06fec9fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37be833796816028d140433fa9cb36dd234b5d5cf6bebcec28c7ac6c0239872d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c0a9b7026afb559e4554254b8de4859cf315c3dc1a7d39671c75a87b1794ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cab7a1c35434d0b21a8cbef13aa4272a8f0a23fe7813db5a3cbb2d1b264f0704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9048480b9098af3589eeae40feaddcba7edcde8b5474d9f3bd0532d339a3f20b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae743a89bc12788b6fa956551587768cc05ad4ef679a14fd92a279bb6a2ac970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42fe420839d40d216234c6fcd0b8745e575918b2f72f40d661cf536a5dfc1362
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7873d14ea837ca82d29cd36e40e35c01956465977d9715d4a9b60de66971912
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cebb00bc00a82e2cffc29d8a032613441b9608937637d4ed169efef160ca70e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b9cefd5a0983a610e17c8e3bcf3895d6f046a7669e07d7462329b647b1345a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37816b0b8b01fe65cc722040a6b76cd39a0ae152f7a87c04bb36c9512553c584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0aa5f3bbc44bcec248b00a73b2ffc00e89ddd6b9579e8925b6a82212979f0169
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 877791e5ee09fbb0ea3a028371c19d91282c3d1d9d8e670a9b9c530a97a0bd96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933ba3a32cbd84672c61b74994b0260e22452b2a42bcff070923d7063e845984
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d9aa78ce0dd264f74b8ce9376bbd2b38679ddcd0214668da361c5f766330f43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f03202be1da5f656cd12f11a0b9e482d71042886d526eb5305c4d458f98924
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b206140bf2f0c40f38698e02c52fbc36f3777bf8347c4eef881179fb43a4f3ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dac18a60bed7f7fb3c88269dfe9c1501c42aa4f73c3692155017244c47983094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd525eaa8c69b7dc5622dd2de25646c98fe9613ddbd3e5655efa4ac798b4fa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b31f12f9a5b52399fd779cec2a38ca3cea832657003d8da3e79247e0647925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda1e26fd3703b4ec5e671013e9cd086d221274f7a7bb5946ce32ab0f7ef47e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 815fd31e7474754aaa1e43c7d30910ea7c7aeeefce8ee7491eb0302c20904a89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da069b76a274d777c30c11292368a9878d6d237c2fa986e156e84749a1c00efd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 221959496ccd366dcc6faeb77e4d047ef9ba662ba10b7dcabdb7cd2014fff539
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 189e5bfe22cb3cf3ea01a7726e17aed83336ea20031bcf502115277bf9a29a20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7d1b676e0ade18c329256b331683d352de95e499e38fe369aeb82e29dad68e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae188704bb02bb9d1b673cd30177b7d77bf053a93974da4e4133029ebfc3b0e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b93f5555300cb98c215edbcd1401e4131ba5de3b96e417b811318915b5af8b89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00753f1ce420902d2fcb3b139c10d348a113c6361a0538ccfb23c95ca4a05e3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6d4c05ef5389c3d4d2961509609fd40312ba80fbc29d2e2fcc145e437d36caa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f7d459332ac730c6ddfd7a4622b30932d932988537b078e93d8d02b321bda47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef10665f0e60e2fc131bb7d7b66461e93f6585432d19b529dcafb567881581bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2187835e8f6d1df0e71f1f2bc357892affa76b83c9eb421ebbff51102796550
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5d2ea38dcf626fc9c64f689a0170772082d626f359dfd1091a65d28fcbb587
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd3c0017511e8330c7360b325ca304f1ac8c71b0ba9d8e0882f200316bc66d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b825312e8fe4c286cfe04be8c62f56d16b3ececbde8efcba7c0ded9b4c298226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5852807e23eeecad5d4ed5ea28fc726290d8b72466ab5a6a78950b490eeeae6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e93de668e5fb3053b851f161353cd76107b15b1811edf04aa6a31cc274b15d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d530c6d103bc13e9a406386fa16f2e78c1e8f40be92ac4a0370058b7cf4a91bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f01eccc363752804829819a44455e11b30d349813880b62744aa7e614a0868c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5df92246a9091e04654e43f648a51000fb91d81d297cf3b063a6ecf287b6af4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9ce969f0051994682dfec20f6f06222a05beb9f9e00853dbc7c120c326a5856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4bb9e5b9467866ef6265a9c3962c496ad065eecc00c69f37c7ddc2725999dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 509c69a6b5e0664e1ba6c8c64528c8d7eb9cb8f4a68b890f434c3356b6d0e122
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 628a2d07a39e3fd28d8a171d0bd36bbad0e56af42e335fe1290098d61db74ef1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0dc4a5bd69849090122f7c535e8b4eea4cbcfab01ac1b2d3aa8a14815d369fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e168aef9c60bb476f1e57eea2baf589b355f8bb302fe514cab749689daf77ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbfc0d194f8926a05332a057e4b04749e955ff5163fc4ce6b74f4211cb7d879d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed08c0a755738f6464db2a65e97cb12d686805f87cad908e12950e2c9ad2c7f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4ac910fdc46d8230a8390cc7d5c10a6d516ae1c319e6d182b125252fb9e6ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d744f3b1428c26bb065dbc12b7c9481b056a4383ae7e759fa9c9053c7cb49cdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 991718efbfb2ec0fc339009c451207e6cd0be00b8e3aba5d926958d649852ca4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c12995d6ebc0392ac04153f40c66c95d794544af1bcfb30de8180ee9e672e567
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e78cbac1a5918672b4e624e8ec2b44dfcee0244aaa1844b7eaaa741d00cc09e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b77b5cd249d1967c0f5e401759b412bfff485245d7a7cc62a97b3e30e8429bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30492fa4d94919fb1b01ea92fda910738e21aa48312297d05ed0ac553c9b0214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3e7c7c82b7461a329322e62a0c30bc3005c4996b2815eccfe4d8227f1130d5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40ece9f730c69c994520fd5dc0cdd74e27ca436c3fc80f25ce1f84b9187c423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25f42d545a49802f9dba8b86e71e0ccbc13bec270f71475f3c68b9653b0f883b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca10ea33ffab64278a17320e5d7ab308e093da6aa4028e09fe2b14d2ec1f9604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcdd2fba6b25cad4944a589bdacaecaca84469ececd0b69e2a9de1f44956c6eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2572b69f38d15cc73e4a25c94a07dd01eb08097842779ac62e743c04ee40d2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a4f2e4e0fb5b7a205ddeac965c1c04890bcdf8cbc09ea766d79f7afa6c4006
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bf2726c3ce4248ef38db5796626b3b20709c0a926f362db7c281fe287f7887a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40a69e1d5d92dd78c2008add22fe77c2718773d6640e53552202fa879e572252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be67fbc943f5e0bab96e1945b42066f42c537642035cc8178c97a7719c5fc7fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ca9d1d3bc7ba96cf765917bc6aa75a2e47e76c93d0dd0cc0121115afba40507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d27223e106264298107374fd45d832d8b207ebb80e47d660fa7a81ef07bb63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 493b199314a6499341085f0f60e2c0ea228ce5b6dbd1bc1ff7730ab274182933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef826db63a23f012b11e0930f25ace2a54e8f0739045060279aa9e40dc7b783
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02569c35964d1fe5730096aa8fea42ec11f5ce19c932e6711bbcfabffec3d2b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2298edfa468227545162c8db98b19fa0c0c4e29501d18c24a98f451549f56000
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c5d17c34a5d6a7ee32d8ee8495eac1d68c6f9fd344faf32ba1848b571b8fb7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5c94bbcc18791c3de1c22f0c36e4541ad3d506711ced76dd38ac781a2b2c70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e897600c8a64ec1939eebede6b6a94fdc91350183927a844c66413653c5e4c7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec6b169fef47b502f10d0c8931dbe4c4d497e1982010f48e4fefd455afcca353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ddd692bdb1e92061a16cb66a3c895abaa0710176883b18ae3637260cfa493b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ff60fe74e11996544e5c3180128ccae572b668c656e6b92e5a23b31f44bc2a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49cc5e21dcae98790a141f24eac57f7099c4eb655e0bef76ac54b44006443784
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 944511074a4e765bb09171a62c3cd95b049108d1b7d51a8d886f1ac261769a6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c74d73ecc0cfb923be8235dc2fb3740bbc01eebdc640cce4cb58c417957308
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ff5031c44782b275682550332750ecfe32fda29f3667c6950e96731cd8f64d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65c0744e238c78acf15a0effca00cd6c0a0d5608e3ffe3e162328677e1a627e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0b768b36e67f5ca70f9e709dae0f61570fe5b8f80d6663b019bb1e623e4e622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4644de0b707fbf359fc3ff48fe3527b6aebc18d31107cae23a4a4eb5ecf6ac9
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/2040-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-12-0x0000000000E10000-0x0000000000E11000-memory.dmp

            memory/2040-11-0x0000000000B50000-0x0000000000B51000-memory.dmp

            memory/2040-107-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-75-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-70-0x0000000003900000-0x0000000003901000-memory.dmp

            memory/2040-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2040-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4224-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/4224-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4224-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4224-67-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4224-74-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4224-6-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/4224-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4224-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4400-101-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4400-102-0x0000000000400000-0x000000000044E000-memory.dmp