Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:56

General

  • Target
    jaffacakes118_Bizarre ER - S03E08.exe
  • Size 287KB
  • Sample260910-dfbxvavejc
  • SHA256 1488d43120978c84d91524442a0cca0ba3fa0ca79e81406339a38686db10a8e1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3280
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Bizarre ER - S03E08.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Bizarre ER - S03E08.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Bizarre ER - S03E08.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Bizarre ER - S03E08.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4568
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:1492
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 532
                  7⤵
                  • Program crash
                  PID:4248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1492 -ip 1492
      1⤵
        PID:2112

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 1488d43120978c84d91524442a0cca0ba3fa0ca79e81406339a38686db10a8e1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 4674beb7313e8cf158f54ea1603a67b198d38eaf28bb6fdb3b3f88224e6a5708
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 52e9ea2084bc51e688bf2b351a137e658dfdfe198750096f079d3d9e3c4d6f18
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7909f7a76472c4b8d8acc5a293cbe71ab930b98fc1923b71fd96055c1474c770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b24b5170d4137a1e9b7b3d8fd667588ae3edd8eced924464617cdc2c70488d83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7237b245407d44c79063bdc661517e91bb1fa808f5d794758ad4a5419816150b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9866b555d931a384936faac160177aa63c588f0bc6b2eb00350e46ca859dab0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9618f33026a3f3cbd5835eab5f18bf2c39cc7d5a908c8bf1d6dfe197d4a17caf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b905c2911480b3bd746ef5149127fd18ade5153c21f373b76cec97587378b139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ce6006227b15d6b1bfb759ccc26a4760d28439f8c84e28f91b755cf46f6556a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c24d9d00cfeacd4b7f04485df78f9a8222178e9a99ece525d7654f9ebcfbbcdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41b97084c2cfa38d51c40fbb44c90fb1b3058606779496866a467e3f15ac70b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d20f4ed7a8c6e99e043de7ac0ce4ef5d7f757e788a7fd2b77c532b743e0664
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6eed94011de8a07c888e164e18c89edb03f98cc7ab968d9848070793860db03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f763352bec58e37a62f81da4217ff14e9f449f1a61e4ba86b90cb8c698ed59df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8d839695a8133c6c6d8cce119e5ace232b6ca06456743ce5e2b9c2a2deaebc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac95aef91adbaf70fe3ba8fa05a1a7e480908ba9dd5a8813dae7b8640a0c5d2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05ba31fc0561f05826a55a44fc43d44b61d3a3cb8996a8ab73a7b98cdb668bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fa96962881a410e6ec93f6ca848582791b44e9c7c62d0ac4e9a196c2c50ccdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34a5d42a846b88aad15674f6a034ed5f365e85f14531cb52b298629093407305
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2314b0d765f1418bcab637c52e3faf64326888832c3c94fc3085e95c9a44023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4acf91e38839e0840a426bf6d51e11a0da498667f3f3a2131abe216b42de45b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a9362ef14301aa4ddaa2deee7d3f360ec0241b8fcb3bbab95ee3a3b3421399e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1dfe27577be708552992b9caf6905c9664d4fd5ffecfb2c8438db264913d9e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a201f77b85fd49788db0a343bca7543b8b45206b1bc6c5e72786a9d2f20861d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8238a7bb38690bd20e89704723a4a73c5e40d92cdc9a642fcfbe450dff1c02ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63e17b7055a85cbcfbe68e4995a45d71c645ed0eb099dffe5e3e158052350525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 059e811b11f285b0da546e53dfb27699a09e5c89c30fed4ea38749bae042cf1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a07431c71ce8a363e1945d30624d64accc1cf2dec0bdb8cfd2cfa4c72fd1f023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d2e10a88c9b036a9ce90b99ac5a6f55189f7579f302bde849434e6a4236a4ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0cf456e712501b30cbcd5f3591354b5eabef9713961ea04011fa9a8f511e01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28653e21784cf71d35437034678a619cf8f1374410fb045072719883a2c31137
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a2fb1bb0ce2c833b20591607ae07803c1871118ce08c083af5bc059d4ac4d5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2735eead012850ea1077959672f3522ba2e64d5e62b887145d0c6aa64d4e2515
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83bd68bb69051caea8d2a6166237421735ef227a248706f9957a659ebc113f09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a0329b5e1c82804aa1c143f91383bef018bfadec5d906c24f0ff8229fa358e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50259d773cff30c8a9d187364964fae89a57e1f2256e920b529395a8db725d8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 111ed999435c1f1d432b45b856f5bb13cfceac10aa844cdb2713b5d7cdf3ba51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d13ddc56c1265fc1c9dce093882ebfebe5170708bb56893808361e82f5f6f095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6c1ff6433f231190fd7285b2cfa15112eff5c5921b26a82a650605747afa4c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e856cde126d64ee97c3a63d7d7fd6d2d6496c1b69a2f8ad39c0a69c388aa523b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 742ca73829e232883e5a79c13c4daa9a52881f626707fc880b698ca9aa7767c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63dbbba4725344f853f81460093775e35ef89e22d549b8b32d43713a281e7f20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 862ca3585099cb826f264cea15cb12612519a9da33b7673a8588a32a0b01a1aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 478dc52bf677a1e6284efa536d834bf318e557a47ad1304b9cc59ab0eb10c368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 800ee4bb4893ae3af472eb2187d4071fdad09db8f279e562cb636addb42c8dd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f85b7dae72bbd705f27ecd336c18d0fcfde35bea40647f53aa259cf8e3fee21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f03fc336730688d82b568bb48170cd3badcb410e0025bef5a997902f802dbc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4298731a4e4292fbf977d747035c78ec3f2d40ad827c54f178c16b52b311f9b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42ba2fcdccdc11c63935f0ebae747ddd99508c9a8bef7e199449ce8caa2bbcd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc6dcd260509269cf154681bb909eaddd170ca053b5cef5a8b1cb8e32244199b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ddccaf7f6cfe97e67c0e34134c8ff143909b9a24b64cb9b52e94ef73511cf6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba79756d15346eeae94ef1cc16b61364d52510118c2bb441eb61681661fa1e55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 504d7e8a92afb796cc9b560ead347b3e6209f4f5fb2a0ef6158fe5dd94d1f102
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f53eca549a7d1b306967d9149f1e1ba7f43cb4a7d035539b7a1168d8bd27c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58effdb5e836ae20cace7b66d3f1bc06658b178acc32eef8386a939d15af41f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 115c3b151f48545e36b2b9e4744e66eafcb3e1eff016674b90bf84f1899e94e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65b0396f0a649b056c65bf07427000ab96b69c5a393a9daae8ab88aba88d7a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5488b1bf35d1ab38a19a7f50b0fd6fc01998e7df811455159a80305662407f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 229aebfec2f4b69794ea2ab8f0a83b936d4173ddae19b7cfc6677e54600c3ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c6053060f4d3ba9ff8667b39b95b89b8d4e5d8284c136c4a157f23122a5f46d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cf62e4f02a584823193569286a861ef848bb9ccc9692645bdad1c70343c3d64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4aebd649f29480a23c620e58ad9a0bf021242a7bafd4e28f6d7d10fe5be0e1f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 850ef8669aea248ede45bb3c0e34ba1b935364b871eff63e6be9c9a5ed86a3e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be684e967775d46be301f0104cef3256b31547f0c2eaeb23461490b6121405b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13290e6093a12c215b72b02a05d6f7abaec5936a8c6ce89ec355018384de1a41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea6d6e6ff5fb92351e787cc64555ed947fa3140ffc16c7fa33129d677f52e864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05a88f411e7722b0b4998a61ae2a560f1691f177d4e958cd482952deee8f6b88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3d75da7b360f3f99d3322f48360ebaf867daec760263ebf6f5681fbb66a379c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60d027d48b5ebab3a6db40b470d92e81cefcebd2689bbcc7c3d4a2dcf34a792f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae725c1a6e53066bcd773b65baa1025f4973f279aba5b8da2a5eaca468ecb427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd2971c7f9d1f831db8cf1ccd80233bcc57e4c3912c2e09b4586952cebcd184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80119fc2a2db3283281b0456b1ea462379466d79f979e37d0a3b747298db6728
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67b3f43a3457d27da1f15f97dd173c4b8ece070d8768355606970da6e0c59fad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9c843073e1fa3085f2ad46b3dcca3a906510b246118467d31a0031c7250fd81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf28970afc66aaa926f7311683b3f6e2591c399ffd346a72875f606ca00640b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9b8b79c7a9b836a2390ac47c3b8b1344a82eb3eff52af604099ed1479d518ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3c060cbb2d1eb9966a75aa9810113c60334ce8bc51b8f0b5f8b11485a8d4cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f5eb24021d0d17b9e4a608f09b2fe4d57c6d931e1ec600da4b4b20c5d92bfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1db8acfa77f4899d214a967ba57c35c23a9481047c39e4091071b95db214580f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3db8f0d7fda0a0930eea087d51d335470b208b243c415520c6c0e627150c817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a308c32904476d9e482bd4d7d2649fa094ee1462808225f5c84187c1bf8acd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6cfadfc3ff3f5ed55223483be9d468bb13593d7e63c97a9cc29e1e43c8ce0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3e6450dcf0e0d854c765e80e87a370199373dc52a847f8057a5db3fc364a496
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f513d625ab4cfefe8d119a66bec284012673c4cb0baa30c9592f9f206bf6356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5f8b147722c62d45ae111da422884b500ebb802122926ee02bb91721a2a95ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7945c7f70a3fa054260e3f29eb550ff7604d0e27dacb5ed60dfc53a70985ada0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ded06ea77559554ffe8b41a46f8fdfa8013af6ed9293af2d0c7e06203f34ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 175f9f01f3c50f81113ce432f59deba96c65050dcf858667aeeb2d9c028dd155
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9297afca01ddb6e23dd06ec841de82200c5ec7c4dd8e4297f1d626cb6a287031
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c17b7e0debf88414428ce1d83c3a4dce6b9723ed73d378f040cf8e7cea37c83f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1c0e38958b3a4884c8215d807837822786fddc4c7f18e5a7265a050d46afba0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 197630a6f315be40ba277a9ca530a1c3bbdd58a651fcc0f4513335284853f859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456a868c64f463bb492b8c04ebef06febf54292663f6920e873f6af260a6f4f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8edce2a855c9f3be0de75dd34ee215f310ea456e97a9427d5894d93d0900ee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d9a2223305ed68ba488ab4f5a5ded1a21d7c11b92c8365b26bce4b5f3a07645
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e91645b676e04169d564e7f6a050838ebdbec6230346739bc774ac9ac7c1387
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc9bfbe76999c86c02e7dc66d3a5ee77cfb49624ff762500e0e815d3ddd964a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12c2ec3be984b9aa9ccb37357219efaa0573b46ac06aca8dd23653ad55377a3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df66fb9dd50687f1d76cd0cd5cf8bfcdfcd47f8b4749e3c43be7f60224af28f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cad35efb785186418adf44665d4266dbf1802bddd307e3d85387c8b5219b647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f44e575309770d078f504115517487ce347cd5a1347496e3200888381f2c2cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb6712afece582d5a6ef5187aa31ca280361fa9549a139b37e1ba1c0b4b10dce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0964e933110359a290f042daa0ccce80c11821fb692a6c18ac47d05a6522ec24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0092fb14f3d30986302839f3d21edafcf678866c16bb74a999f3a566dd12e41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61c5ef84f036b934b3db8725913df8e62443e21a62bc8a9945281f6d3e4ac7a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a9a2f38655f4e3adc04786cd403ac1b459ffc6dc54281afd07f9a96b1a9f84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad0472826decd51b037787c01770e7c813ec5dc380c79cc30cc1655decbcfcda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2aab1c1afddde89d541134dd995b770872b7ffc595f696205bb109b70039b8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52564a48992540cdcbffaee7b3482065cb2e1bbf830629f054b323cd9d7bf5bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e10af7abaf69b20cc47000cefe408a89fd49cb3e9cf380076a57e4661c13dbe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1e5e8fa28bdbcabcf9a208d963205b9d12e20b854b77e7e9cf19ac41a66d1a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b19cb49e84fa16208e264a6b35bb019460ec4665f6ae567a2b8a8e52be195a8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b90186bcecbe701013f90be5c6c61d2005a12e2ea60e72638315081e46f76a59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cc3a4865e1413d1b43597daeb571a231804022aa247b041f26cfa3d2efb6547
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 512feaa18f2dc70ef400a8bd47347dc5a02366f683dc084fa99965370557aa93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3369c23501aeee00c00c68f8027e7459caaa7b2b8019ec2536edbbbec7edada
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f5a4de0e50f0d17f03a724a52a5139f6e87fd187cdd667bbcda4fb504afba7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21bbf1d48fcfaf9b66709914e40b8e83c8e0890098165b5e1f8dd2e5c81f0cbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc7d4744068d54d3aefb9c37fce345799af54ae98cafa2b4aba5ed3602ef6288
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40e818c48af5de5f690c418e98d54d11aa270ea831d8a36b567006f4e81949c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51909b98da2442e36e64140f0a2533fe285fd2ffb82c72b3001aec23a1e0615
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be84322dbdd3078e4f46ce57165f77203f9fe44e453aa7f1524b7aec90f0cefd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b3fb1b22af9e60c32754dbf2a952066b74d89bbf6928145ea85b9f921ea2652
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e11cb24431d12c0138b8c269aba1598fd54ad18bce3fa54f39f38e17fac07cf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c0b9c71900a6e03fc2ec7770363c0da0bc7f6087e7e62af946fef787e99732c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4cdfe3871bd1e2116375e33cd08affe8e926c4c74346bc62c6ce9823ab0b27d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d678f917471cab5acac9ed7c1728af77e66efaf1cc09d39ff3e44b35926c905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0716f9130299acff08c9406516ae1aebb5028cb97b86d457b9259f2e1ea66c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2a804d54ffe4633fbd2b05014cc18c150e6bc3362839653d5b36abac400083c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a3259fa5d16af38203568c2cb4cc15df6ba3bfec2a1054b20392d563f30ff0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ca369f8417a5994e64838ba68f4d85318fe900f4b10823b59a9b7772fe922be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02570d90016b811811b7b7c8f8f03681b94e7bbe5ccba1cd300045eb58816bdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12762c4d24651834a44e0ac52ddd6df67c820c61f3017188f99c5c67443f76f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a1d60d457ac02735a04ba5494f0e4ffdce99bcf214ca7be77656ce9375b6fdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1edb46691a901c8f0f7e4264788d1008ab2b61e11c7339a59a9822bec8766f65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5e338f5c60d8a93f1ae6b3b5a39f079d656c2bba190db8491d0fc535e623c1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de28dbd57bfeaf7340defda97ea841445fd4b1d1249b18866a82e88f368891b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68d91ff457ec6d22b2df0601f0c02ee651f83a1ca0e4a89b63362780dc9855e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d0a457b1bbff2349fcd7b658d30005d55f21e325a312c289fd1575277609019
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cab82456f1867be407e17d8f1ba46b722cde3f6adab4ccc4c38ff8e57c57318
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99cf3fbf7f3c0ab4c86ac175d380876c17f0f98d82f79232a18dc3f79c0586d9
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/636-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/636-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-27-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1492-103-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1492-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4568-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-71-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

            memory/4568-81-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-11-0x0000000000D50000-0x0000000000D51000-memory.dmp

            memory/4568-12-0x0000000001010000-0x0000000001011000-memory.dmp

            memory/4568-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4568-108-0x0000000010480000-0x00000000104E1000-memory.dmp