Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:11

General

  • Target
    jaffacakes118_Father Of My Children 2009.exe
  • Size 287KB
  • Sample260910-dpklcavgkd
  • SHA256 726ea25e86f76e0c9d3a363b4b5e106227308a0a52ff255a4e4916aea44f662c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3252
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Father Of My Children 2009.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Father Of My Children 2009.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Father Of My Children 2009.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Father Of My Children 2009.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4112
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1176
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4152
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 544
                  7⤵
                  • Program crash
                  PID:3576
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4152 -ip 4152
      1⤵
        PID:4556

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 726ea25e86f76e0c9d3a363b4b5e106227308a0a52ff255a4e4916aea44f662c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 c724833385d00c8dddcf24b726211c7293c602dd42f9accbc72390252455630c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 2968e956a1afc18ad24617bd63cda252aedeba64e55d3613c8737676da45061c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d56b1e18d4bc9bd710b6604e0128b37532afed1c613684391df1a90cb27d5ca8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 752789b07d19d2d075a910b7380be3a5526e5ed363a010effbb75867ef0f2225
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caae3ab9e4eb48aa62717e194a117fe5623231e780b1f547b449e9d2bcbbbb52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b109785504157f4733b83658cd066e0e720854a9da680885e92dc08a203018e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cae03196af153472caf6edc516857db6ff3e58f9f13428e8314b5c4774535ee3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2da7a327626821a16ff1329e4fb81e3fb88658845a830c401b05fd3791edec59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ef478f5945c7cf8f57d20c94c70a9d1deb16f3b36b9b07d71e65a1e2da650d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaa0bfed1d9a99d1d2fd6856a983b5c155b1768efe82049e5d2c9c2e8266414b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55d15ef97ab06d9970f4f71b2b4f63a6a0384f4c7eaa7f642a69fc683ac8d10f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f586f200d2d9c199d3a1e4887e4f61988ee9d03aee4fc633c80afb68c520e12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6b2c09e5fbf763be7015c007e9d937afcc6212c998d648d3c027ad081a6ed4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab231f7a3fc019a383a6a35752eb8cf9d0d609ac79ece4f2270971669e528b0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b4fa6e6ab0051f185e480c4a1e60599f85ff436f5984673160222b486c08f04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3a0432175298a0a9c8999c955be5e94ff7d0776b4d4b3568ce7e27efe0420e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43288218d7427c981b0eb1a08350270a7363b413b02513f734fbe014b2825850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5179e73921a249a762597c91909c28abdec72861134cf0b782c66b6f7a0f81e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caa83642d6e3d41a46427d0027b19fdacbe8314b378205fd1d0d1ff7884332cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 681af58771a8f83c80e1ac9476f1432359955b34850ab7b4e756c1c03806451d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcadf670d7e67328f3f2dcc8a2711c31fbb251a0084be50fad7ccab89186f9d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2c7ed3f8df4b1a3fe5be39433d40b8744042b648070fef266fb11982a0b3581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67580cca60a2dd66dce059e71cddb057929a28e0ca0b97ac07d54e31c352bd55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab3b83d558215f21fcdb444a36f436ec923ed36b1ad81ed7e1f6eb5f70434ca0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f207385edc2a214c06b8b3b076049682204933d09e6ced9a44fbfb394fb45506
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e093877c990835c708913ec45169716b5ff31fd9bfacf6a961b2bdd695f57186
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b19f10c8b1a665c17e8e7624b492acf3204947cdb1e85ebb7959a87acf824ba9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e9c1f7d650f439c7dbe1827f5aa172caeb67fb21d29c0123a088075a98c104b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9492a079374053413797f14477d07a9e196b6107e0a4f4927a1d62f99316d49c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e282e980dceb3fefae55c0f79bf6a1aec813e1476f33875a04f973fc480a10d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d2266daf33b718c126197c197b17bf36bbdb7c8c908d452a4cc2f0547e3184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9708d6764d4df29491951fd64c6943cf53444672a0e3f9a62dc966456dfa6ebf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee4efa78d418f3f409477d9358e89474871c541ad3671f38df0a03783f63009
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b156702c993b9b53f8bdc7725f9bb126e619df48bb1886ab447608310770841
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa17f9097d2182bb56786aceb9aad2efab7237c50a40f961c08e68524af3b274
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e960a51f8c4eb4fc2e990f6b5a382f4a122e9d9fb662481df0ab7ba2db2523e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15b8a68d6b6642d96ee4c9dd1f6671636c4e5a8110fec7dba25c15e2509a59b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87141858deec00fd927a8eb234f6a31bd5d09ef1159ef44a3364324bf3c003fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6aadba2805970c23f06ca2fab5f5b79950a3c21b8680047157fe5e25f6b088f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6c159e2e58cd52bc7d9e9ae0811fc64a22aa46225404daa2a802074d5f85079
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b46a0491912d9ec5d30b88dd0bef777dfcfbb707596f5f658046ead67b658610
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35563387ba4a3dd847f88fc596a075e3b7f7527610d10ef188d9450f60a5350c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3e4625b0987425703314d86832906762d178b3d69e6d973330bc710e100f2a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00d3a22362b56d284dd81c2ade11b4536a6cd2b9fc69f00e28f7a7890e5163d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2713b1f520e24cc52f9082f3be3da21e412ea1ea5efe3f2f0ab1fc63ac9d734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48a6d523380f504cd2b0fc660bdbf90c4fc7a52293e545885f971aaccfc78945
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab0368d5f967ef64b78ce504cd35dec3fd8c604df33f35780c98fb4cb27aa3cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97417da54697a50fe068e37eb503878eba5440a8c6ade14a9d960b21a06598f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b18f057c59ccf2c6c27d4b324e5f6f6fa7eea85a1e6243f6358c8de8ae89cbcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b04e5a33a7d6d60a0dd86801d813a60e9adaa8c7855ebd9446d8f1c995a902a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a4bb09f014163bd25980e7d2822b286a3e81a2d02202c864e356467b722f4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82dc906e24ff215806e73b57aa6d675c801ad27052ea87895c55c748078c1de1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b373f25f129807168bfd16c102ab3e3f6ee3d66a9e4c9fa32b8a58c5a6bcdcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 655241867d324fa2b4a60418a502c499e15ba09bdcab4ca07ac604753d4560b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61adb73636ecc728e00685decf6f0fc64b0d6ddef9310f251b80c9e8e7ca33e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea08cc7b604942b287751e759e00b9ed59a4314fa46aed675868ddcadc68f5f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d870e6990f9d8fe458ea07178f838aef463dbadb7f1a7519bb42ea90710ed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eefdc5e0234b1ccd62aaefd627eb19984a368c26872eed56f9dba9c52c343662
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6e2c3c56fd4496c0dd52d0552fd3e913d253b6d6d76cbe6eba71e8e73c6e79b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6c7ae0e3ecfe17569af175a350b7f1a76fa55fa7758b2292e235281bad03cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 220e9a04385b7d9f5a951321962ba291451a21cf9baad8714ef2af27e572a678
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb87a408bfa059a26dc8e3cc88a7a30a74530e64c3ee7e606714f697f78715c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1085f2744b2319c442a10a00825d4f5e82114fd0e27ff5da3f4fabd05ff53d7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55e59f919a915553ae96fefc4698f19dbf72feaf5699ce50e9241a99381e4efe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36c560b6982e528bd45076b98abb9566dd8b5639b16aa86b64fd5d33a658adac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cb15dd71cfe6b4dcd60fe4e4bba7b46e9d3dced8cc532a87bfc3514f81a77f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b6f63fb33c47501f311f4a8044865ac69e2d9c8ae234de982fbf9ecc8be4e97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11814421653563a5a2806b7d10cd6bb76a809aa4f4c32d44a855364d47cee1c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3216ae0bfd3ca5c7ce798980d6f38fb28757131607724ea62aca527625985b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03b5c064fa6b3a8203ea4f53940e19fe196e8ebed7877188ef8f2a07f60ad92a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3319986a8d0bcdb0574d3e9287b9452e096d86ecddc40b29349772863303119b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a080feb6108338fb1bbc220c8548c5e484f2e1ec3e21160a9970bf0f8b553344
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fc5b06a66c17b5275a2f356a8ca4c8b9e5f201e86706523b5aff4d7f6014f98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff20d1b87c6c906d45637e6c99b8968e22b4082126139fbb0267f0e8e31db21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4dbe5942c1689991f13d6b39827ee22a863638c1c762b0f991772d7f932e16d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfaff2ee6567bb4302d669769fc1be2c1e00877a0e3687790bded06b408e8c22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a12c5bb5a1f3bcf0b62585ca1222a7cac97eacdfe569ff1b368c5dfdae3e77d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00cee41dabb2212d7f881ea8dd6b8b13c69f162eed6b0ec603604221de2c7a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9be7834530af2630b9fbd8350a2bb664e444eba56bcbfa644318b81257e0811a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e31978b92188d833651ce59314465d34c5ec5b7794c821006a77f7847b99de1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 368821f4d29f03758714f6a561a1f5f8ba5c600eef586222af8930f29e2b0252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0c7a86ac20cc0ac6991c8b5a0a9fd0f6d1d5e4cbf7b9c1fbc01e138a837ae89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f4f92ee256a0139e77166167a601a0ea0f9f7e34bc2361f1581efb53033016a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2a3b7f0adeead2c34626a54a0f3574eda35fc429c30e773fb88f2694334ef18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 134ce16afd330a82a011ef2c2924d313f7d7db3d607f7fb8547c4034accb4268
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65b061a50771279982adc11d94c9db3c912cf8a33a6dd6860d86046f93c11b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5b9a3f3a48cd51702629505e691e872e5d10291a68d0edad715d04c5b8d4c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e6cf45d50ef2d58c19612660999610a37b1048a452c4be89601f3f79c962f07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ad2b895ebd29c5b51edbad437c6ed692e1a0f1b9d240054a6a7cb61a18891ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61a26771ff2cb6dd7302b98df0d05cea4abb22f7d86da41bc3fef2bd90301d24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c230e41a092bc5a55a26bc07f94c1eaa211c2b95e9e364bb4040aa98aabbeae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8859405e2271476ff785e9d72edbc57bf5e4880d7c692944e96c0f1aa75d9eab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2a4c1fabc386400f25123c853f519092900504b6a5df1840c5cae9d09b19f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36e0622446601b8faba0d7f7009294be83fcf05c0a8aa7d64e5b6b65d8ac7b52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47f41b54e7df7cd84089244ca80e264993f05bcd17244f30c1cb7cfb8960974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d16121fbf76a2257b2aa0166a65320046d7adc46cda98a3a4870c2cdd8e954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc9b971109d6cacb96aaa35e04769ca8c12167a50b84c0ca543525d41adb8b54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1544b6286e11a7677b871f91ad1e017512d3397000801c9732334c13f7bec5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd463d30a9e157cdf0e14c0fe630ba1c3f35ae1f76e0fbfb1fedbcd8cb9f6253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0da7ef600c33d7b1082951b303bec0d5bc3a3a9e09a693f602883179b74369b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 724d4466a07c66e59aeb4c21aee014c89f4dc5ae63e5057fab4a00788f3fff5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2344889c0c86eac8b01c2e56627337d40b4e56135bde74f1c987f34024a66948
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2d1f3ed3178c93b1ec3955d2d44be8e2bf7f04f6c3efeb8e4f3e4ff12742d75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f0e05ca7fdf2beadaaf3d26cd999b0c19285f568f4a7ac2e7a65a18dc29b875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2516cb908823737dd586c3fc38814cb9d7065b384120f9b60efcdb0d5c77a5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dcbf8e378a03a44757bd3b222e913de20b5e0b77c87684c7e33827384677603
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e88986f685bdc492b22dbf6f877346de9bff0c593f620c74fca87807c17437c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46be6ee7f5eedd576272633f2c9fa0d9fbb74566c2342c98fe33589699472287
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06fec3f521cfe52c6b4ff9ed108011bbc2ec827b9c0842e7a6006877ab403441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b3d81164b7a1b9d7b4f6bd7525abddbc4a2a01866d64e0516739e93ef45309c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5f3d0e3dde8e1bd79760ba14548a557733dab5650afeb27f2fe21e81e24ab24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9196d2dce28450f8c1cd9e949b4438a6f4811f8fcf7887747a8f6d62758bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b4b1af4ccd18ba608b459b797bb69f75578048705456c1f8c36390aa4f6407c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa35cf2e49ae3ccf4f420fdbff88a549b3b767398ae4f91a3a98f0e656aa3ae3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc8cfe682f6ff693c598cdcba6cd84803252047e3fcf344457bad834c59e37f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7392e2d8256083b2845f23316ab8ccfe8c58bbdb1c6d9dc6a30f1bc93c58e054
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6122080523a6c93c74164858b42b19354b4c00926099d981f42120c01a056e4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1092d4930385cede5c692f10fc6dbc7b743b1f925acc053bef9183da93952ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f3ba6a915b867e32e032b55dcf71cf879c50b203b29d72c5b1a854ad074600
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e1e5f3e9714e3abd1a083847bdc26f5cfd378786a7945681eacddc48f93c459
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb2a0d2faba6de6913b7537001a32f026fe588cefebcf73ceece4043cb8cc00d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6570d9ce33b526015d666c592397e314ded65276719a3e234ce4118c2307f301
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc18f27c0b2e4d1d5973ace78aba5305f7be21ff1014d746170a85a5054349cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d755dfe7fae76934ae3f90bcc80361c3c8c10859eedb961269362673e45811ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deaa67b6e767754edae2ccae9d45ae8ab279fc210eb0e7e61aba6c226903fba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 696ec33cd274c3ab207736516347938e2d7adbc441e9f598aac7ddba4f9c7d75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1973cf885732deec9e99612eb6aa9cf7fae49327ff2dfbd46885d03bad5b38f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a0451d6f7d4e6c78fa9248862e172ae591bdb814f6645171a89d984b31ce33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1271f16a347fe13581e483dc44a2612540e96cc6cc51133c59c51a0a61ec2c66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5368dd67f40be02972deea8fcc592c2dd269cb4986bfe4ebb180f7708db708
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deb9dbaa6a9cc9015c0fe6cfc66af7ca3ed535aff02e4c9c16d40389bf5f1901
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5550173f257a01e18d0cc615c374655b10aa1d068f4fdc5daa5b5f660029d9e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b18f26d8e6d952deb533956e508d8331eb42d5e5e98d0d251b98b4d938f6f6d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92696581be7d46035c0c64487e5d9f4d34294b90b56b154009301f109a4c4ee9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3718c4e360079fce77acd83db856e5979f210edffe831086b6080f02a3b5be81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57c215185848c4e642fea42644c0ce72fac0d9d285bcdd9a025d481b9606ea0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 005fd5e24b8cad510e0ea73de60c91b3237d62a44e380ccb9808f732ec5312fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5fe8049313f635a6900594f82cbeddf98bdcb21ce98ca23611a8c16cc8c915d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48c09c166f6b7c497f117e66b301a66df7fbe4af33ebb27c3811a65a06770a60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3adc8630ed1180bc3977495b2842f5a62a356dacb6bbc9c7df97db21ca700e60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 649a84b9840270c3238cb073d0d3e785a09543ef919a8e2f6120fbff42bc1522
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/1968-71-0x0000000003660000-0x0000000003661000-memory.dmp

            memory/1968-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-11-0x0000000000680000-0x0000000000681000-memory.dmp

            memory/1968-108-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1968-12-0x0000000000740000-0x0000000000741000-memory.dmp

            memory/1968-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4112-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4112-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4112-8-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/4112-69-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4112-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4112-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4112-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4112-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4152-103-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4152-102-0x0000000000400000-0x000000000044E000-memory.dmp