Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:48

General

  • Target
    jaffacakes118_Blogger Template Langit - Blogger Template.exe
  • Size 287KB
  • Sample260910-dap8aadm9z
  • SHA256 4306a00101059aefeebeebebbf2c3b4c5e7b84e43720080a6931e614b27dfd7e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3272
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Langit - Blogger Template.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Langit - Blogger Template.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Langit - Blogger Template.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Langit - Blogger Template.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4716
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3952
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:1760
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 536
                  7⤵
                  • Program crash
                  PID:3472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1760 -ip 1760
      1⤵
        PID:4408

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 4306a00101059aefeebeebebbf2c3b4c5e7b84e43720080a6931e614b27dfd7e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 9b8b787bacbf28464947edeeb956e71cd6f0018cce4399d3717da1d4b2e0a8e9
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 c56cc61893bdc0912ba63156a3a0526a57b128a1f4bf8118f8f533f373058cbe
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0483938b2bfdd5847bd4e08f4c035bb02c1c1ea41f01cd7e89122c325056205
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16cce181b1bf1f4e574d4e133fa15e0da45bcc6aa89a8afdd534d4fa4c93898c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e80b0f4acc590c41689cfdc636c5507808f31e5f79ab6dea92d64b4edada18d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79a3fa56ae5f72f6d77d357ee3d8f9673a90cc2ff5d5952bc0a40eeeafd9b753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b7cc933e9285a9615ff21e6831c5dc981557724eb0f8a975861a4a33103aa5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89312fa7890de9efcdcbfc39bb5ede62dc47daf97efac6efd534047af1f3108d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d0a87054406e2e96a505bce6936cc8e4fc45cc2e97e3020cf794086ff77b09d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8071d470c0933798a7d3826503b2a49cb4ee9e397af318742603d723fca0178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b237aa3045a20c6522564f1dc0fa77fa00813bb69550ed3a19088a43b6d1fbfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fc58fd19682a5e709c4ca38398e3c029ffdeed8a964ee30a2f70da5bcff8b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31ac0424e30c6b1608b89a79d1a71be0d93c77d905f9c60867792c857251d876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eec07313223304a82418985adeb89d32d615f2e105699cdb1558b5cc5ea81554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b14baa6aa086638e2554df574989e6abcd4ed876b3f622bc730d7dff940cf067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eec4f9d1379f88cc8ccdc5eb6aecc72b24143c67c3f547e6d5e6d688a95568b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52586907d9e914f13d39d66f99eedf67c1846057e7c513527221df69c1a35430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c32c79f26cbea8a578a9b34b9369624a1ce7e72785dd91dcc5f5d0313203287a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c025a32d2250242fcf1c44473408497ac03731c3264e05d11d8f7fe6ee6c2b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 286e48b280a88ec577efb2067e10d8372b9d2c8001ad22f8f4f7cedaec8e1d54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db5e5c3dbd21287fbf733991ab5e5aff84cc350c8c3442b68eef420d0543cf5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab844ef832c0ae6664595b39f5aa9360b3aa5d3f7a2f36768d09372d161b38d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f8a0e246c60be1c33d4b4d424b87f391d9457ce0bc61046e8684efc09a33c9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd1387bbf50c81aa29a8fe9cc3d94b6d9fb4fd0e924fc3eed72b5e9b00ce8351
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c31b84580cbb41eed25ffec2daa76fa2170bcda26819fb066ed5cd373d0c35e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1cc33b96af6e7cd5f8eb02c52b65b0448014dcff4820842b32702e5cb86fb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3d9d1951aa2f12be8cebb952c6e015a2716c7b77f112a474ff14094e4004115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f2c46d8624becf7a0cee9bcd7a0691d1e9cc4d0338513a0cf4c8acdf6de49e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2870b3610585b92dac4495a487e6bac39e377d5b456fc50282767eab41fd9f6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b5aea9a6c84ce7aa3bc92833d5672523b455947c36cba2464afb9b9aa800426
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc700e7cb027d45e7e3ec1831f0eef9efef040e02b1a2f63eda5434207080b7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b537274f9b04e3cb2cab652461aee32e47e232cc74d230a60a2e141a69695695
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f74849758b4c7aa387e61f2097bed8bb3502f0c20ab79eeb41f176f3c60747d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cab9c4b6e338c672dfbd5d069866de00316ddda505808ecbce75719ae228a17a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813266df30b264c029f15e9177e7286fdf26599d1ef508d4054b3045ba434201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 525f77d616d6ce80ca583cb535741be165e6c3af95be80039b7d09b9debc7545
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cce1db6e4c78a31ffb39006e685b08f2720d00bae5bf329041d7c9a6fa5c94f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad579ee372cd853119b71a201f918dbb0022a77d0787a11c815a0d6779b70824
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 498f815ad8959ca440b41f18192bd06eab144a38b911b51272da4919476ba180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57dc6076a46911d0a5ff19b95c66cce86a4726a05357ba94dd5b542ebb1cc944
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe64e2d7c477f7f3bc87ce3230122e93829f15530b1a4464f901c7b59eb896f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbe4d53e400ede46e1c2c2af12f034747fe6ae2d8a1d4f33179c4dec9f497544
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64609cdcd7110454333fd275a87c6aa50266b831b11330272b6d41ab7ff73c4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76d7af1dbb6c1680ea6b9ecaea660bfad148880dfc889d156bd20d106bd40d70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea36f0631db603473d843f7e4e0b66d6aa2a428df9a455205178c1fa1db5a8eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 045a9bf19ff15dea6f39dcdb105dc545a66cbfbd380bb2c036464ffdbffa43eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f26b699d93f1ebf95f9492522cd721aa0d70b4163b678b4d7fe958133b116a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d9ddee2fc5352f0ee639cadcddbd76c2699ea024fce4becf90c31d459f681e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fca50d050dbbfe6913d21d903dd09dc7a69dc6f3113d089c5d7f675887ef9eee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98b665e9099be3ea634e31067d9d887a1fa9bd90c90105726081c7f3c3552bf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60c53ff83598764c4ab376231f90058a39ca7e9a688fd69e4d297491f164428f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0864b8cd603c4e5f573f11e35310bcbdc8e696e3631d1bdf0ded51c8a133427f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de9c58eeb915d0dc985a51c8065f3be14a94f9893345fa6df8c8d3aca75145e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c08c969425d2910ab4b797e4183834f2e0c95728cae25a67b377e10f729b2ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e407c946f667f62993d38285d8422732c3dedc3283906fef6679d65d70537756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 621c3bf73384f44c6b8bc14931e9cdd7bbdb6dbd3e386d52229da4d98241c088
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 698f75b28626f26fdfb5d0824a6dddda6aeb7169164fd2144637c574f8542f3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8336bbae62e09b754aa4b8f8a3bb3f2fc57da495d83d082e2ca2caa502962425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7201f64a1415ad5636de1bf93ed8066c3894af1249f3bca1df8ae31bb97cfdde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c1a90eb8c5c08e755a0024f9e4d42e9051ffcff5d11e313e74727d7058f7c98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e319d35ac972d6955707d35b4f36c0fc5e7e79f60cbc3b0c53ceb195b5a263fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b240b11969fcff72c59f4248686e50b5a0d463d93e743cc919caaeeff09358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55531dbf80c9c0169102633dd4c214d2b6de8609b651249098928d4f87701445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6746a0e0f1d9351a4b46439af9823c7ee30276ed6dd236e4e4653b1e88f6a8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2162224e3bb2639c88a4dd38ac17766c3de2bef6c88e782e58ac80ec431951c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c231225c5528c161ec0d74531f6bbcb04ba8f4ee6c9f87928e7749eae5fae66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c02d11b1583eaabbf75e12f7cb0b5bd61388c9a1682f5aab0cbc9ac5f9c9da2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7007d3bd6eb4f8e33c24bdb801a09f6b710306595165de4826ae41c754413e5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d3d7c0e1ef3bdd0a0eeb4a19fb260c05bafea3a97d93b14a09306853275a5f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea9d965786c874182c9470b16e4f71b67b4ab0af9ab0cf93002922ba300a442e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a5aa0c3aaa3d695f2db0977d957ad9261d3903482667ed4ed4aeed9a658a983
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a6b018d7eac76b3bce0bb8672c87e7c41862bcea4e5401b86f1188cb2df82f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2087db784de7e3716883cf00d6eb21ce2e534e0be2c3ef980839a529adc1a77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1cec891e38b989529667e9fe9521c283c5bda0da76fd5e534bdcd68d0e9653
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ecfe035b505ab9f2356ab5c24a94b095fb3a1a7e61bbc20584fefd08a318bac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccc02ea3371fbd234a45ef67c654255db6e281d54d2519a51acf16158c5691b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 408867e5c32cef87e3b0581af7ca9ce95ddea5b2cd4e0c7f5b83cdaf5fdce869
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6af3395f2e83245a8730b09d85b02daf13b26bc9f1ffa326fab69b91fe9069ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6480f67ed918c5eec9ef169f456226d02c306ea7b5609b8b15161a5b6ab9dc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14daba965c0833daa9cd2d144567f890338105fba2b9db7eb13d51ccc972af75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d20f9825031db3d37e15417ddcd376de0320da665f886883fd5cdbf722a5ea52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e133543bed9d0bf0bfcd46ba287cb605fadf7d31fcd258df16125e1043779bb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202229a4b8a337a1c6016b27ca88ac5faa5c79596161ce548eedd1f4dfed1a2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3d3a70b0262be4857db351c87a14fbee58f1e5807b8ed554b1a0ab457dede7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10ea0c91faf4592314850340be90fc4d5fce5cfb76637a311e2d5294f0db9e87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3999e5f9fb99c86561f30f9112adc6b65acee9265de991c20928a550adcd6d14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f0961c6da0163aa5f1dfb7328d5607d4fe2f703786f63b3eda1c664a7c7e1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a9f0d242d1f11c23c657f00e02f349a182a3110bf960530d49f79fa5b97762a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e1403474d4182a97773dcfab28e4973fd0340430ff8c8f09235c4d55bae17a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 007a121395067a1c9d83db3e6204384c0f74502ff96dac12b87d36609fe6a9b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 573bbb98641c1e6bec0e5429653abd54df069c7da1b93b7785ab98a69fdb9c36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5344760b56ae5f61e9df471a420d4336e86859007132faf7e7a186a1e75b86fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f66a4880f3147900afcde2e3df3217a31c6555023c8149dd7c939dbd3df8403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a89b5fcfa10be3358c68fa0b848f86c20af3ac95bf5798a4e536f1b344d49f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 652d7d9997f18139be99cd463d0530526e1bc88e0c0623c4919e0d5c223ede30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a869fa0cab28b002e73e73be203cb2b73c840c7a89d0b6a188d18e1a34f322d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52577cb97b4b7c3173a6207d9d78dab180351c97be18e8bfc3b7b8183dc55d1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e895f272e08b3e2eb666894261b063cdddb18052bf91b4f998e76c0349722b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32d026983dc0bdfc37e0c69e4dd9ec10b6d71eb750bc1596b338b597e8da42f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e9dca0e6988058ebd12a4c6580984b112e93d13d6541f4b5176ca895fde90a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7a819e802d447fe5ebd30557257d5e23a87529d970e9c888c602e0853ce3e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d118a629c294d1f99aa4e08fc01cc67e077df71f4107a7f41d0b9d7eec7194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc3260e3ceb1f0b01fe520a640241fe019d76407906e8970f00db092e63f739b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f550d0b11e963406e7482b60cc342ddb268fe19f53767ec401c7c81adbe8150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b6bacbfcb5f0c0398496e35a00c31fea7f46c2db27b3d68891e49fcedb38a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 290802ea2b2786c330732d3a0217c59a2327554fa7ce6dec3d3746d3ea487d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a8e288b15ef80c3ddbc407460c4f1ac55b2a93a68d30dafe89f8f8472d74d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12a8f2f2fc596f2ebca83ccf3eddb3203441a33898a67bdf94a1e5e5640937bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81000ef135aced099e166a67cd73b47001fb27b5c22d26cce095bacf3003b2f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab621719317a49b2ad4a61829b584c0a86173f8c79b730541c735c8ca33eab69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8063375daefc5607b87f1e6b232a0ed540fd8bd662228d2fc6d96e0b87918260
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba1702ebb3fb921db4f3618a232b84930144938bbdc35670501ca4266ee5efc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d17f5fbef1126e90352126be5e6e653037a8d42f399c0df0f7bce2529093e9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 597fbf250892fd170824bd7397868ea8a85c97c21b559b963203c18f87773083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f17f920809f71ca015e4104e64ddba58adb28255dd68748217112f6ed4136c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4f6cd5bce131efb29b620db6d5b19a2e0e49e1f04b23ddfd9a25d28632ad1eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee79597c742d26e3fd4e874164aac8797b8f7b93637803f3020c4fe387f3321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 555dd4482ba5bbf66121bae5264260a980b137e4ddbd1e0fb5db8a6bb8308375
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c818dd7cc073afe4321239130961242a4f21cef67e154391b01b1ad6758cbdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7824045a8c7dcaebefeec3f59446ecea456e2ce629a5b3b1b9ccaf8d4dcae64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bb3584ab2a23750f2b76c255bd4e8e3c9b476e061ab68d9552c6a1180584cde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38d1398a29383d8871d7a73d34e2f07299e6f91be27eec23cf0d17d544e6d368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86cba81a5376e578fee83a2db854856746381f8b7588b3050d316481a3556f91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e05f384150594a6ff6db94455c515c927ba2878eac883c30d81380634eacd6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6700bc6442286316d5b8cf21c9ac257aa6d8d1fd172b22f59e999c2c07b76317
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 677aaf9caa57da4ee283e8faed45e7240592168d565590359d971b51076fd206
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1051b179bc81da4dcf4f876d69dce73ba066c1fd5add9f25610721d166f5ea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ee5970c81c415ad79e2d37adaa1f35c17771bc046a00da0ccb40b2d5ae20a89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d091bffe6182a34f811b43b457e3ccfb6dc7fd7dc5f4a113681421a7e5462e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04bb28edb10d265128800872004cd9e913bf183ef8e5558ad639dc33eeb8ebad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6154bc1756c76ebadb80f1b3ad4f27a6fb75f4b0d308d8fd2d2ba6792c7f7c8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 900592f4b541c379ac9695a9d605cf962bacb96e54d79315b44bbe93b4499f45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b16b8d771fc8c29ba00a646a00b68c71496daf8e457cb2c14f10ab7f185a595
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63a83a0524df88add6549bb860bdb521357e143d4c0ce4422261983cd3ff2a55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa638b0c38812dfd6e77c6caa642a6d150dd85c74f19560d9885708fa379c1fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d462909f6bd4ff2dd86b52bcfa7c467970edbb33dca18de799468a5e50f634c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c103ac095c0cd97f342e3e0cf87464f85a791a2a2f277d717892d65c5af2114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baed6ebf7f797f855070c176af4143903148743b6d0c50e4f5327af91746e6ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f32eb37ebac154d541068b9e0769defbfdda2de56c31048ab16f286f71d71ba8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2169b78f33f480e9036a9f94b25402ce6634ae9989fe8fae471f83c1bdbc962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1267056ed446f9a1bf6e69a0a52c54f9a64162d45dfdab2fe71f85b4038f3b8
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/1760-103-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1760-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-69-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1864-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/1864-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1864-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4716-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-11-0x0000000000920000-0x0000000000921000-memory.dmp

            memory/4716-12-0x00000000009E0000-0x00000000009E1000-memory.dmp

            memory/4716-71-0x0000000003900000-0x0000000003901000-memory.dmp

            memory/4716-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4716-108-0x0000000010480000-0x00000000104E1000-memory.dmp