Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:17

General

  • Target
    jaffacakes118_Kathryn Stockett - The Help.exe
  • Size 287KB
  • Sample260910-dtfsysvhnf
  • SHA256 98d2afc6d91e415e57c24242a1fd4baa43a0f517ce519cb9ba33175687e5a834
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3328
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kathryn Stockett - The Help.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kathryn Stockett - The Help.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kathryn Stockett - The Help.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Kathryn Stockett - The Help.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:856
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2148
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4304
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 532
                  7⤵
                  • Program crash
                  PID:3388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
      1⤵
        PID:2956

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 98d2afc6d91e415e57c24242a1fd4baa43a0f517ce519cb9ba33175687e5a834
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 c354540ccc3b0ab01be41973e0c23a4beac78bfce37e146f9dfbf5dc3bf1571f
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 1245918e41c9d6b6793e9605558d3cb144a852278dd8b5497c337335837ed5f6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6152e76d75894c303224052181d96a3001d83f9b1afcc4aef2498ffacaee5273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5abc2570e0a7b433f7dc3a498e8232aa52a3aa1b8cfe693d0ca3fde6d7155f7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98d4038f824f9ce0f5650e99163d113ca2c99ac9d5e74fb40a5f4e24be19267f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65d7b3829688a422ead2081443d6157d2b85d1ad76315efd8a095180a1cd4f2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a32c23f73da69fc961a4ad355273e652290777828a0cc80ae0becb68af56145
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a15d024c200642528617239c652d6d2f0f5160def20dfb49a35cd7612b3130a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86c996252859af5317e6ae8220201caf3c9f3c656a839bd9f4421b2060a80f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35d68346855cb6ea543382a01f3e75075f78ac42ccaffb6a81f55ac7e4029749
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eac7be9bc3cd372fdd86f051ac3ea8c05a3165e8c575d645282736e5ff1dcf4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af4e578538e1c1f52b3467d8f927b1ffd60b1226feab58398a48f39432ee86be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bf049c177fee52e7a9544a90fef5acd570a090f8325c572e5b75c41494f139f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2684ef40e54418a81b29c36d444dabcda8ddcbfbc608c5387e63130c927c7ad2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba93f1cd22cb40bc39bdead8606860bedab0fba5137addac3616366b3453a3ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd2231571a66ace7ab48b3523a57e154c1edfd870164e6048fd05b43faa5cf12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ae056334c5ac2c4cbfa29b7212e53899912ed7f84be4500d47965863e1efb6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4e57e48e2856bc709e277d950462b89cd99b8c101dca8c44e1644ec611ac9b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0afd9e5657b815854fbde7fbac72d010f34be323e52ac8f2aafcd8190b8361d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69b19bc0649749b3391e3146f5e9262c74e1f18d5fc395cf8076bd1d156d1533
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e20099e2e1d0c29a01a070ea23bb5ab0df2fbbe384b4a56e8fbfcbc55c80c3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7882723ecc766fdba406320bd6f5309be88a3e8b9db192abcbd2e9a122d46f19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91e4870326350ff7b59bb2efc03d0170821e87d15c4037638a446cf42e69603b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e3e4f66abae132edd41427962a2ac4126b3abe4a17c6344ef1c8aff240d0d2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad4c2544172e39dfcc843319871a4c3673766ee68176f1365a07d4d9a351d2bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de5a1ff44e7fd0583a849ad09a15dca4d3a91b16fc3e119061b764785b4720bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69ecb1ace0ce6aa4157ed5ee29fe9e27c31f4efa82097d866c602a21f49e8669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55488c3d61c921ee7ffe0027f5a34b40821165a7cfa2eb1e762b9892166ec694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374ff2bd2589d267d14f5ef9101828f257a4134378901e7fd7c70530dfe4296e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 477cfc3f5a5bc219a289ae9b18bb9019508e52a81925ea8828e86fc46012aac7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b52e30ac299ca092fc327b2ea31f7b72dc52508dc70dd5dea73ade29215e727
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a997aaf3a092f85ffa88a8646eb953bf697b5563a65a9ed0609ff421b9a33a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93176dd00e0c394772eb867c5f9bdd312a7ff9af79bf2a6ff9ea5f7f50d5559a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f77e498b79089e3f47417e67359818d3e6cea44f9282ccfabd829122bdcce7d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a06a389d6131064ce76406466e482e3583571239c8c472e294b37bb8c8db12c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98722d264f6dade40d6f287e2b91fd87300c1cc129ca73431f081599ec3e8022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9146ca5985102395ea52838f74c90bacdc3d4273f6965c3c02dbea3ab5719c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f31230915a4aa8e061fa17429b30f8efe6d3ab86ca1046c4be97ad136ca9ae82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1a3da23248e389d492f449e00a43282c31714f5642de21a2ca1338366eecbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 922f9de9c5079aa27712ba7083e6997eacdf3a5a3ac6f62042b4074d48fa5d8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89b496657df93c452d1132e0f4f9d914ba5d1ce0f7d6fff062dd75654944fb84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2dbf6e75913510e72fb974aeb4790be79f5e29da7ca9bc8edb9d27952d02363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70045c011953d3e3b41321c4ef15a293b6e14a8559a14f63ff5613f15f7e4cf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08cadf58da114c4303e7a24fe38cf5a4afe07e36f114ba711716ab71af1b09ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d148b6b069b922d13a83e0479d1a50e7861c2f29c21812fcd2ba81b1e6b731d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82170388c3032cc699664a7678213b876a30a8d788210c81be507417de8f9219
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7b1a1ec2ff9160e71d16620d09a25e04d767fe36da2c78fcb8faeec9d75abe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bbac7a30b637e7e8037d46d116dc7e68516a1c5f6d4087050aa33dca4dba325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9ef6f649d3f1b898640579192c73d751e06ed6a4c5d2f1a85c9c9196d4ddcd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72e03054f0f7b9cb4a01a2b7baa013667f2a693098ed41145c1b0562614573c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f30089acd843c7fe028a65de15e65aee464f5af89dc2ed4ada9f252cf85a3d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 298ac409b474e3be4c04d475303dc86fdddc10879e90798c1ac4f9788bafdad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6f53bb66fbf73cc0d2559578a191c8b44bb35f58c28af8f1c4e24c48711f638
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dae0ae2a1e7e7e49096892e2b8f815c1e779d38e363ba7243d96e52e4142f6ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6adec58240a1cb59946243316d2a5bcace27bbe3b9374f1057098605ac5a4925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 069154afbc21b7c6a603883cc2e56fc513e666a05af2d03c4c061795698f0677
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b29164aeb3a0b395554af8853e497a036a12597ba270fad1ff5ce92d8a757f56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b217137a25421dd97f4dfaa9a7e8e6ca6833f2f8a8a628802b272c99965888d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e180ad82bc91eefa08b3646e74e4626acca9585ed5fdcb4e30fc11aaac461a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9bdffe673c4ead5851cede867454eb1ebdb3e07269634821469c164c1d7e4de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e26772907c87c0c574e33784a63a59bd8e8dd9cf2711753fe08072646840f5cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 765745fe106b61b52518f5b38384fca41e6ab5c444ece4dc70561e9d6f66476c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7a8726c391f53020e910271eeb8469cffad5e12d3de53c96bd37f43e84ab6eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30aa15ab45378f4377b4a2a3e3e5f95a46d4dcf3d1169c79a3161e0cba5ec1ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3120ee9f0d6d4735c598ff92ac2713a0644b3bbfb74af26fdc8031e2ff4bd265
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ca61a735ab3035cf93da9ebe09e41a9f94092b7863893945e9e06db9ce3fed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 828594a3a17237f3267dafd25d792becfb021d11e7240776a4c06381c0b243c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb63e53e5b15649f1cd0ef29e363f0e07f94e119e966fbc1c61719fd99ea5722
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beb6ecc369e30301722afaa24fe8ecff50318296ea51dae03d54c8054db6d41f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7173e215e9f74c6ae0c7d19b783a170f65ab1f0d6a8dad76c22baf65fade26e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17e87eb49c6691132e9d7b7c6820483e6e6e83dd39f587252a69de683c792377
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2acaf530a112edbdbe6fc0128e0d876f89e4648914892b51e309e05bf2fb448
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5070719d6bcc1a4687eff6cc247ca356562b3a9cbe02bca6446f2fb42b424b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7554b2abf7efb06a101ce013f886d062707c0faba718c2e387508115985fea2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af0c4a9d144c2f770ff6357ad9d30e1ee436a58ad518a03f442f7f80ead690dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e3aa1faf2b0c8af17ff8b75bea7c13329c7e9fb632c77f8cb12aaa32ec932d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20fd23f076f2dbaf6e06d57e67f1ab1bcb808820c4cc02488a55a17a2cfb8ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f94c2b2323970112ce318fdadcf84c22751b2e5563802a379110566276f3b35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7d1d3af83909a95836783358a41b859ff76d735f0d2fdae6ddbe66f82a9c290
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d25c50d955c6609b0b636bd1dba720fd592dfb98de64234c5ff6bb5c312eb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41df5db1b1af89eb0c174fb4ed1d4cc26060b49ae3bb5ec6c99aaa827381abd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e88c2499322203eb077e324d11488c44905f2b97e3ba81fe3f69a53b5a41d5e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e5dc9e912c6f3001aa58b5f139b55ee4dc824b4853f3a1992464458bc119398
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b20d330cb9de163949d75ab07c4f2dc43e56872ccd42842acc0a8db91f503401
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a9a097fa585d2323aa50fd8079a1636e22e2d31b326e07eb6bfdaa645e2b0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59cbdcb8777689cc16e3935e58bbc74cd62ff55bac9ed727efc26be64a74f4a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6edb4656f6727d489dc0f2486dc825ea283ff21d92c315449dd41624c7bdd0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e51176d2d624ca35c54b5a0ea38f53a9a822b042d43d4fec39cf54321d72d810
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1039e25ecf645fdf5f110301eadf747801ef987427213a64fe5c13372a2b9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecfd412cc6ebb986177165e3dbcf7607cc243b942556c6df854de425ab7541f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9f64fc8e6e994097784161321607e7b1f4104a6f11043d492ae8cef916b669f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af813b71736b42e7b44c79c77876b2eecb838af53bcce1bf5b09e812c0b49eab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cab36da79bc0082880662f0d30faecda4b6a5d331e01da9841139bb187d37b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dd1f78e772d177912351ca9cee0f13673439f1115dad39b6da61c87032774e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d1f9669ad3f0ea1dddae8e88e7c9460f84726dacbf2e316980aaf247c8ec435
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f7124f3580c203eb6e5b76a61d9177d6dd3dd62095e683807cd6fc78b047c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0e37cabe5285cb49661e3b723708b90d13fdc5a43ca8febcdf514bf928d1fa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1155f57a1c36d338ab34d077cdf357dc27624f1f7f490c9d33a50a4e48913d29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78f67450477a5b994f20879e61852005236cdcd348ddb12caf8c17c2f0c1443c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1ab2525614f3ff7eec9edc8bfe7cdeef9dc9ade92d0cd6c30a36e207a08b483
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 971932338f97f962ea77c0c310e3e5a5f2e8bb29f7193770aabeec53a14efd04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fff0ddb8647558c926f8005e1b663b096b54af049929c81a5d97c47ad11551ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4150279d2de0cc99befb0f556fbc05583bad14e6c6821484c33fdd1a83d0178c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5e5530263e7313b8b28c88f8959da06d2de4e5bdf330b6a9d858839ef87b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec9ac06995e7d6d24496ea89b22a84a12e43cf0e37eddbb954fd65e7c8efc075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e774451d498303939b450202a0445827e06690405460457225b26b149f87eb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43e97af79f7f2b19a4330e09ebd34bfe70145bae6e1a77d08c64c977782e2590
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32cb7c579b9f2600ecc242659336cb8fc559f999d61143c9831c0a35866516fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33160f2b9c9c5557d681f415402c355533fc2ca3a27dc0c6db684926436d0e27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f3f035b01144044fcd272bee2c37885ac73e657654cb0464561bda54ebd0e7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68162f9612849b35ea8b0853814900fa436754242dd428e9dbb0d71eee596dea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78c559d11ce4a1542f3aeb947539993b0fd7c102e67c01042c996b6b6d9822b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58aa4c12447aa39bca3bb06407569d845146d7308083f15438eda802afd32949
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56fbdf6c5e57959669f5c5f3e892ef23ae38b50a734843ffc51f1c5f7d0c1c25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5259f156b4673b2e4e8ed859b704591a66c1ead3dac403f3e6c8fe9f1934ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b753d6f89787ca49677cb390d36a687c478c3f27d80f224d11fc37e2297f823b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 679dd5633109f1aa08ac71f730c0a75afb8f57a6d9daa87cbdc857e38998c330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e565cee94a91afa4757e5fda54aaed83d898bc1ae7eda126f22d4e385b5648c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deb2f776df05f50f7a9ce4ef5bc3cb3dc798db5abdffa15044f954e3b3b8872e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2011ea2412fcb06a8b906d1470d234e487dbd5b46ce756a29cfe140ee3e3a0ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fd363987dc0c2fbe2d8eaac727054aedd95867dd88c5a3335dd942c906cc1de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f35f60090ca012d457fa849118842862b462bcf342c8ada7af126ae6a4e85a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a61048324f8d81dc5dc559d339e60306f2d9ed62da9f429a2afe62faa304324a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1af0398e90c3e0ac6fd94f208c908a35c38598b6983e4c769fedc452c1715aa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4eff88621fad640fdbb0488fcf4f3d1e8d08ce45c06bbabeb7ffaf904b49944
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a5a915922784d918f39746229506f7ec3ac77e5000f443b3c5ee77953a5c565
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 664d78264e4173616849037fea9483a7140d57ddb98ab8197b429a5c985595b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa020e01eb823e102467786e660b413b30d81ec1d3b9a6e35ff8728dcfadf07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9aa215bc1595ee7a772ec1c949d6701ca3b9a9c9213d177ba2e0322c8a1d5882
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4bec547e003fd7a8cc0af0ba97f99c8ec81a66687a7799775babb618fd87f6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790e051d8574f4cf9f04ba3da20bf7337cad839e7852fc1a9a84bdffec703cc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55330f0a7a7c2606d977013afb2f0862ea477ca1107c387141c82fc93d4848b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ce56c87e4d1f6dd55ac7d23a47ecd50612e2e1eb307e6e76749e21801bd1e25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 953b2a2234591fc4e5b424fdf35d894f773214132762398c19b726436b602d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a5d1b06cfb58931b300b0ed8c938b97de769657d8533ccec029b85f8d9b4462
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d44a2476533e5cc373b0fca786fffe4da6b20ad3f6b43cf34b18731b76d2082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1f4b52e37ab188ef8f3a501ce2657305b4112436ac3b1b4588287c55597e03c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6641f0782423bbf9219852f30d467226b528b54d1bc007ff8cf0cd776878c79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e38330779cfdd9dc647f39202358037cc222bd2c7cd783f3be9cb45033ca30c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e9f9b09e240616a086f3a425d874db4412b14338151dfb0d53c025d1a84eb5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7a9b817a2062c6c810426ccf191224e9e707c11a460392209ba77759d0f2fc7
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/856-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-107-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-11-0x0000000000400000-0x0000000000401000-memory.dmp

            memory/856-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-12-0x0000000000900000-0x0000000000901000-memory.dmp

            memory/856-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-71-0x00000000033E0000-0x00000000033E1000-memory.dmp

            memory/856-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/856-75-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1876-8-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/1876-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1876-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1876-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1876-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1876-72-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1876-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1876-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1876-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4304-101-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4304-102-0x0000000000400000-0x000000000044E000-memory.dmp