Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 04:38

General

  • Target
    jaffacakes118_Blogger Template Simpress - Blogger Template.exe
  • Size 287KB
  • Sample260910-e9fnkaxhme
  • SHA256 35e3968619e4d22b07ce61e7b8bbd90980df86392aa035a99d3138fae9f40f16
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3264
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Simpress - Blogger Template.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Simpress - Blogger Template.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Simpress - Blogger Template.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Blogger Template Simpress - Blogger Template.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2376
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1976
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:3524
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 540
                  7⤵
                  • Program crash
                  PID:4744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3524 -ip 3524
      1⤵
        PID:4944

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 35e3968619e4d22b07ce61e7b8bbd90980df86392aa035a99d3138fae9f40f16
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 04db81e841b018a28e8fa51b36a61cc469ca7cb84715dc5e27a1c4ded7b237f9
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 9a6a212c2a177387f98e32370decc204058b19707e3c613c283d49ab1e855c6c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8bb59531873cd7580ed8c3718078cfa35a8aa58f792f57121af906feff71e48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fa27be3ed517156245d2964f4dc4066e64f8916efcbb1c82672d2df1c8384c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f2d4f9f2d029acbfec3fc59b82ec0e64e733b37f5e9403ac966b4aeab7cebd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f00f4fff14a0e3d7cbb7e6d66ba2b94504488530200c60458e0431a38b4d6809
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d829843415b62efe5f15b0b30b52e726b4a8136a809d2d225e8fcbc44cec1ba2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbf26dfbfc1d627e18f8e66e654592c2ddc4ba3a68c28c7320f08f0e6069251f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f529a9cda7fda2f27f9599295f9376489ab83b82c807ece4966860c24c02a4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b795f96a2f6cc7325738d0520256bc2bb39c0b38cf27ed0dadb791bfca94698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c26f7602de27f285438918fd1052857a13ed8356e8e5a0664c92937b8bb3bc13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb76ed2f2c084080f68b31cdd249c688dde4fa3cf1cb0060064f4e2ce7dd4230
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eebeeca65cc129122057f2a80af18bf7ca2f89c6157956fdf1943f5383d09285
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b3a2befc3707c36bb7670fdae67e6bf91c6a8e02124c95ca0dcbd0711370cca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddb54c19ae754fd43587a1fff6cddb5f0f1182876f34a3a75a1fe1d0b0d8999e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2459a06f54722d587e29ab0270c2599d9f2647ccd944c6eba874373ebf5ec4f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 852d33035729d3ed8bea0509e064e0181e34697076abab220c8608fec99462d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39b9396cc8935a5475c9601a985426932898c517c781a318a7ccd43f910ea826
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb16a019acd6be4f92d9819bb505f39fb1d3a0c9808d8e4751227b3bba7c38ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 763c1adeb2475acb74dc4984060bebec77ab09ef9f66bc4d9d27cce7bd502403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9945723796d4c7cacd164a60ea3b6384c9bcd549cbe8b032882415f8a0cfb3ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b317b30a743ed801ff72f86cee236a7141606f95851d753a19d6e2ea1b85d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ee7b9b2d77aa7d3badc161d4690b473b343a4b7d20ec5f69492d379a12e9b74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5611c1a6a01304a7ffe21d130131c9bac07fbca980af6a7749e73102f1712a27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df5f3736db0703eeaf3ad1b546aa093c56aeca96c478c6ee1b46a92e90d58901
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05b6396254837938b2194c9d27dc4cd91489d13ead284ab025cd8a15ccf3edd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5d12dfbaa3106afb62da69a15dfadadcdf36309dbdb471d5ac66b2e98819073
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 135c9ca6caf1091d428f3f1d9f00f19ad9945b52a5def1b618a6a2a159675c5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 287b3e2e4df2bd51438f1acdf22d0403f5cbbc1b30e91f066b648cf3c1d40dcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54fc12dc536b335ce88dacff1826f9f51d5cdb287b0997bb68e06a1fd62dedc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64083f75b6efe967b061f5a757cc9b386948388b1a7ab0c245ccb42d06b53451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 938ee10a30fcc1ca7ba3f1455b64bf6f20fb6ea670132b94dff2977f694cfbbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9351d07138ef51bd016184e7c6df84f4d3ed7a2e114d42d7ce780522067882f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 281efa1dc80dd8376328f3a611a28b93f883f1f9c39a9b763a2a5bc8b7968a53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75a6a1adc217fe59d4035116a5e8df2e7e8b560a4333013a640fa09bf0c1112c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f0ae6e59bbf62d500f809d340367fa4f1bdfa7c6f1568988025195e062cb95c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d267db1ef64657e7e3196e48aea93b18e63a0ef83b6af55f646bed1f671da445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ae485f85f89a9276bd61cbd6d7f98488b4d784c04734515f10ffeba6c67406d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f320365834fd997756d6c9d94466ecb137e823d9beca1bf60cafb17c0792737
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7abc8c889078cbd5eb3814d21cb8457e8094424b315edff321eb27f720e67649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a82f72014585e7ebc6678ba92df782d6edd15c666d2961342c9cd117ac7fc32f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd3c23bfdbdb8851d8c7d381e331d2d157fb1647476a928f15080843a8a6b664
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b941ffa0c239946200abc2ee02199fb9c7436723de153a92efee6fd83f50a08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e244a7371ee916f74d7c6955476e6b58f7a5e30f8984cad775a52ab4408da9f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d76aad7aecf0bea3afcca99eb24952fe86bdecb66301c8ecdeee9ff5f5e2939
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac2d2b5c5bac67f3d42969d00e3cbd110094b930864d93ab82ea3573fced14ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b64b0dd89dd03846f029c8797ccc90d6afe0056ac61563ffe188d4540340be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869468b63c82bd1556e6eb42184cffec57ef82b4283194887b9cc55460a6e6e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9cc53d4b8e9fbd0156f4f2010f6312f06639d8fed10d59d5c36332d02c4ed3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e4650d9faaf8c9b42a8ef3dbffddbeb7117ce95552892dd2b726a61ca4fa8e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1723934f9486488e7bcedb69777e5a2b1754ed4f770e870f89a6fc32d9e503cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d6549556658d1a471ed00f88e30ebd064d60bf8607795aa5c0e002ce3988c82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8df1639515a48734f63209b6f16eee95365f3a5c3cfa34cd10de3ae95f3c561
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d1f3fd06e6e85ef2872f490eaa81bd0cc0b6f15ae2a35cfeac233a68dbcaec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3261322aa69edb50361e7bed9a8ebb146b2e76552089577d822902c45f56990f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0314b10434de14a1c146a2a9548be96a422dd78bb9abb2fc9d98703857012bba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9a97e40aa304ebffa386394405f727dbcb5d4c2ba0df0e35ec54b243ed0225
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6caf6beabeebcc42ade2c98a6e88cea3814484712f86c802fccf52753c1d10c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37a7403f91fe4bf82c1002f80ec2d151fe1b570e0eff0550a7c6138e31d8e60e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6026bb922da4d500310f29369670bd8e961a7e5f7d34d545df770d36fdc3f2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 049e5fb67f968b42d6260f451e09d63312c77ee584cfd3ab0ce89a9d9577243b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b71defbebfb54c5883485a3c82ea11fd8ae1a56f37fefb6443db222d77a947f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb942044552072118b3ad063921156fc89a6dd8c70e8ad085a05d1403e64f371
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d5887457c4d4c863f3cae192a985b7996cc19483caf2700ba4a412e776a41e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4367ccd7dbfe79035b8560d8972fe8ac5d3c3881f2b420996d127614d0ed9cbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b22dc26b56785f14ab9d0980db4ae8b5d7886f97e7d7923573056f17fb7bb77d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ec5684346335008e95d3f8a2d052059695d8a47ad15543eed79bfd905ac1328
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 022a6d76975c79f1c9ca9ac59a25215898341b7d8affaf834fcf4fd2eff107c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31f13b598d528ab9f99c22d3ab02774a69d45546e8335978ccbbf5464a3f2821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8a9d595a810c1d26e3e269e1ce56484d2ffba27abe11de848a0b31d98793717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1601993675debebb8454365d82c055354728179c164cd40cb9168bdc160ee1c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad572167a80b3245a7cedd93f1a1960df3c8af73d532ee3906f7543edd38ccc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5929ec8b360fa7f6e35cac86005a5dbd402dfe348cc7eca466c780c1dc3d268a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c0a362039e5c70fb7052181b1cab6442f6c66057cd1368bc35eea124d19739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a176fea76f3fbd31f00a44665cdb9009918d2b77db83a3911c083f9a0ef794e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee59a1d6c8e57ba2855ade5bfcc2e798d7a6cc478ea92ce1dc6055ed0dcdf1ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d00000c6cd13c868af95179eca9f37391d67c32b5c814ca83c0ab3f87a891eb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14782f0ea80f78396be0caebed6f3e084f874cf6565f230f01e188f9add75a22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4abea0e039e4cc6d800ec31fe4a60335369144e0eac5a27f4728fe1ed6faa378
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e52975e984227d7609e037f4321165475ef487b331b3c0937848de2416c1d973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5849e0b8a510b0f4c08afce19b3b89e10a47a7cb717476ff3b6c26f6ed1ea5c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b028db69b43d30c041bfec5bd4fe9eb2696c9454d4e0e1dc316dfb209fa54918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0745a7ffd7f400fd1e8e97d18f917ef0df5a789acf9491ec75bf96b1a1e42332
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f7e765ec61a1fad3fcd34af86792e08e8633f1b4713229ddf43a9d18968cfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebaf77099d6ab4281e416c6c697d18fca012ffb6a128bbfb7e7ec3499695294a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16a06b1b59cd6a962364d18b362c7e4a9520d8294116fb1fb5c920889c67c669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 767f8e435826301fe6445fa89dabaed25449bbacdb83f198d18a2a4c99a7900c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f8d67c4043c4c0f10696fb55c33ef915be4502fb8262d3904eb8dfee84b614
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73220ad752dea5bd3c45a31d0198113f89f205db2cb0be65201fbf04096fa971
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94da69a2c4f0339b2d9a058f217a90e169ec421c66e6272be561e25219135d58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2bda6976938d2bf44bb9ce4d03d7965b30f5361d719c8f3e884f033650ac6df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95de7d020278d24201595eeac7058dcb429f3603f9172411de8191acafae2551
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edcfc7197007e230e081bd16d917a10fc145425252c0dad746ced0748648df51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b51778cba04be8a4ec509b2fbb0038f4828cd8b40244651e0da21cf413afc1b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1d1e0ee22498f90fc43b28ded458c025550d30f40c6b5571cb7edfce382ed73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 743fbdf20acc0174223781375d950bb3837c3adc4007a5734425f964eb380cd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c1226084a185fb8049dcad977c43f823d2c3d402d970f13e5614dab710e22de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ba47a91bcf5bd5037c90892123469bbb2ed32ef5fa300079145191800f966cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed69d154220df1dbf53bf1692489318d106b41d9493017701adce5c0625c32fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d392a0e808fb5e3f9dc1980a8789fa4ebbe91ec57f9e7acd3ff86904c63aae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 471af690e65819f63e4ecf6c6845c9bfbaa98b775affddd2ed560136a26b2cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 246dd5edb3ae7f360c32b80db973c88cf71a421e5f4272de424442ac6f3577bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dd9dc63d82dd19ea5f0741cc97e426b03712779d6ae46b0860e974d3109e24c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a882c5d035f411ae72d01f4d3eadad3d8870c681af6634719d6db41827cb5a54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7672309da6d6a475206fdf0bfae38ae8ed0b0b02c5b16bcfb0b2bef64a2bf0f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9901eb14c8baae5249427933df2c3b82be575b562d43426539eb46bc235564ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e34ac5a9e850fb411c25b3a661115859781911a1bda76e450f31cfc2617d32c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8df62f0c785c557d4b621d0127374b759728f90eeca91d913f344a785f6dede8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28834297913b21be277409591abeb06fb1410b757abd3609dbc077f5f20e5fe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc1b7019861825a1f7f5114603a21c812fe6530e5380849a935c33f45cce9923
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a06f65b773c353fbceac003c9eafa2d8de44317b6ce6dc0a550c777eb5100f34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e5f2ecf2ac677360119ef0a975e149655749a9e8a0ae2db36f4460cb7fa88a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13ab098f9ebd5a690856c41790eef66f99504fd2a2939f8d92001b8aea977509
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62d533008327698a534a0d51dbd3438bfe93ce3b782db2a049fccf84a1f72efc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20335eedfeb0f7f521c1b3142d32f4b96d7ba87a36f3e13e4bb30c49c4f33251
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e8fc3174e3c0d5b7daa336cb33717ca614db144331ea2004aca99c95c4f5e3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 548cbd8b789aba097a39547db43e8eb8dbfbf59816eb21f8574a7257904ae1ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee85de10296b7c3252af7c193d81070651d7d3622b9ce1640fefc88066e3ba1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d2d4e8bfcd5410e5fbd5c046d55a7465733c08670af601423a468758c736f22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db78abad4cf5a85fbedee79d42e88a86a6dae9470807e3b3b2661dd526adf24d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e7c202aa0e1cc19fe25166bfa16636464cfe0284d366f09d188edba56a80df0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4b6b3f2cdf2a26c2498484e780fc3d38bae0209d2409a22b9f3ecc80084538e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1e1a8cfd94b1476e3b33bf42d9362249c5c756afd65ca6cc5b01a5e14d4cdd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bd9d431cae9c278ade82720b2ce453b5ec928c393553d894471ba00b99b59e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bb2abac45155ffa2286e12bc1b1c3b14f125952147c2345dda11a6dc3ce8080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96b17cf49f4a2b929e70619a80388d8156b3e8fc8ff8d533d192e6b4ee168170
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f85b1e7d7b8a6dae5a49f05fd6241e109c477474652a4a802af699ad3e1d9535
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b0275101cfeaf7e07e3438e91e818c307572a76a297e1879154b0c7d4cd6288
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4b834b1b57b4ef797e21ee5c43f3c0d70417e15ae1908fb59933fac88fde74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62f661b05e27feb300e4adb83ef3b8794ff63d92225cba333854136122d0f963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8274b6d9136b62578b5d234b22751cb61e7337c89f7ef1092be5d7357506fc2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29bb981a7fa0d784005faf61efd24ed22a2449acfbeb74f2ce44f229cb902ec7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16c091ca5c7d63a2129320c7a3d8d31e5ad543461e258bf77bb34882781c147b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8623c40429aee673e88c0c2ca4798fc8227017a08e140d2cca32d2acaa50db12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22b0e7522cab49b981d44bf273dd15a841ffa57f49b8692bdc717aca0899f23a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c475432c5db473e5eb2c5a29c1dfceb231a760c04351039d2925669c0c6dad72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07aa8c43e7ba09b60970a6fbda7fef641e4f4d2c562090e7fb4d2dcc9f97bb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25acec81c6782ef52b34b7523f00bf2bf572392918993b502a7701b964adc0f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d386e236ddc41af90a8bdcfe8f6df5337edc3f8c12b3a280a24d2c4bc8a31a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54dfa56506ed6cf01c91bccefed6c5953fe77a6aa7d8f4647d5f68266cd1b212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0076ac67362d27e1e47dc48aef18e01d8349f2d9a061ad46593cf6c175795e80
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/1888-74-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1888-67-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1888-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1888-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/1888-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/1888-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1888-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1888-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2376-75-0x0000000000380000-0x00000000007B3000-memory.dmp

            memory/2376-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-70-0x0000000003C00000-0x0000000003C01000-memory.dmp

            memory/2376-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2376-12-0x0000000001120000-0x0000000001121000-memory.dmp

            memory/2376-11-0x0000000001060000-0x0000000001061000-memory.dmp

            memory/3524-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3524-101-0x0000000000400000-0x000000000044E000-memory.dmp