Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:54

General

  • Target
    jaffacakes118_Its a Wonderful Afterlife 2010.exe
  • Size 287KB
  • Sample260910-egldcaer8t
  • SHA256 76f0a34fb7f6dc87b6834159b5d4185687030c37b8e2af285a3caf81da427e0c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3232
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Its a Wonderful Afterlife 2010.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Its a Wonderful Afterlife 2010.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Its a Wonderful Afterlife 2010.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Its a Wonderful Afterlife 2010.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3304
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3324
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3568
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4980
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 532
                  7⤵
                  • Program crash
                  PID:4288
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4980 -ip 4980
      1⤵
        PID:4272

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 76f0a34fb7f6dc87b6834159b5d4185687030c37b8e2af285a3caf81da427e0c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 7f250546c747608b83c99fb0548f260a34422c1c8933b5643a1477c6b93416bf
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 5379882285f95b7a8ee678cca0fdd76de5cbc577abc009bb2bb0df6acd7e0e89
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63548e31ff16dfc10e451020f9d9a0ac718764bec16e500c893ef6e8d793a7cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27dd7c1e96815a70f8aa5edec003c331a3d79573765fbbb80607fe82f01a1f4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0507792bd030453cdbeba1a18a7fd1455d23f449b35e3de71e98bb272dac06b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c989f01f51922add7930a78bbbe0c2d57e5bd49257b3525bb4ea17b15182e13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3e090dbf5c226bd7e4303f42f2ccaaf929d4ed0dcdda2079ba88c94db45d27f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f554535661c2fa559354d09098d96a31cb1aaae1a818a31e5be8973e5973e84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52fc37659fff26a15cf559cab6c7da1a4d23c5d84fe9af18c534c0f75576d77d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d681b48d749b994145d95cc9950add24fa7095b8a0cebeb00b0afab32523e7b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16352d9fa3468afda67b9f5ddf96e948aad2fc1b7340e4541928ecbe092e1938
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c97409a4e784c3572734c7129d86a8ce5b236df6e3acbe1137b6437f05246ac4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cba9a52e2072a3a3ea87b221372e3277b54fcbf413e7567096212df81aa6bd45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17d80351ca9f3e79b2b8dfa5e071ba2207c3deaf5bdf87d4eeb7715493bc58b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 264421251942feada0ca0daa68fc7daf18accdb9655ac78960778c74523e5330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b77d4954f1fd50d68ad88a9e33ff1c58d432ebaa9d4b83202cae59b98d035a0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c4c59a3c28f9c986d3a588d608b36ba0bf65d78d340b6854a2fd23a70f0cbe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd35e12bf5bb5795a2c5448a4743529f78e881e0b4f593ada77b51db045771c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fab8a41ddce47bf7398584e3afb558d33fd01abc8f2d11f842ef164b83f539c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 418a53b055fd8af4d069cdd7fe915f28fe0997ac6deac42e51e50f5c3aaf3c37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf1fe773d1aa575eab840bd5d7506cff1cbf89d8cb7c0abc56bdce2fb0155a51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c10e47fc36da834019cb067be3dcac23b587921c37b2968e4d0a1dab87c2071a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47650e32ca68c8fe23a3fe31d99f3d7217d6b5b87dddf8feb84a7a4a48f39ddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81f79ff78cbee437b952b184ffcc54882ca8d87af5da059a704d10ccd3e9ca3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b68a281bca3c0022d15f7c116ba445a08dbacf7ca0bc1341a2a8ce1504b69147
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 688d05705f3b63d3559d228aa4b278aae31ab75c5b73de3492384df435c17136
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3f1ca37ede008109dd4a9704a36d68210140d34ca4ff8c1639dc7be49434447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 114cb767e5fb1e29f1f38a63921d94f12ed6e146cde130b0ec1ca53267cfeafb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9f8055576be65ad30dbfa3d88a1f699e1002767fe81862bf7f9d741e9de6fe3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d4a1fd75576e7e6bec424532b910ab35bb3ce3bcb92e284f1ffb9b5f02d5abf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c533c78335dfa1d2452d22f638e3e3f049d1f93dcd7cf786f59fb49603e2859e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28fc5c6c639f7309b151a50f07d0f839f463527e30e64fb98ce9cf26a14d42b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2921c600e05d7e7530d336ccb28209f3467cd2d9e7adcea7ec5ba86d93978dd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7a53a0ef06dccf7a2d06514c7f32991ed4f146bcbc96c07dd67c853977baad6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06912c36d5edf6e310284a318e7fbe1d4525a60f5a57432b1c5e256255aaa70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdf2375b422a591ef7072d564aa6cc5ca7331bfe80d06dbad34b5a68fd72f114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79399e11c7a4568905cc0cbe2f5d71b2600c98487071b8b3ead7ec91fb850c74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab75e30798844bcbd15b34e7eef5cc65571b35a868bfcfa427c44c3bd254395b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f9ea73db09fa003b884f32db5f24d1bfc0dab8d60d374689829b9923bc21867
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a6964eca7a00d251d3e50e2b52c8bb33c9f47bfa92e7c5d94249991a4acbd93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ecc9fd8b63486119746da1c7e8c559e10dadbad094504fc813c36c421c02b58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6bd77a5913bd2a47e3cb6499a45df126b004150e867803a41ac8b6246b63b34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b756d375bc16a4e7fd518f35a442abd557a8e3a69c8e178dda363c67d146f8db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb982bf0e90ba33279c7abd158810991304eb30d298ad00aaf59c54a7e3990c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58ff109ebd191954d37e18a984f197aa4b3791c73db2f79185133c42fd593285
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 365d5b041ba76e0df5fc9406b10f9e3eb0f682d6b45405e6b358e547d34854b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cad601aa08871d052231ed7c0d64b8dd36b8c0d30f0732837e849b3d3dd0019
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb8c76607d9ffb71cda3b4c50a53be8552181813f9a092e72c0312bb3133f1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7012c53397374a5404c88931a7a74966a88d03729a840cb91625aa77e11d8930
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef575df63392e44aaf0d7a2f4a99ea26a6e23feb1554dc5cceff5fbd7556e683
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4264d89f2206c6ba4990ac88a3381610c5bb75d963e089da173bbd956a8510d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7be3c294f5ff211f654345f260831c7c5abc230a769ad5f818c12680c5ad1bf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f1f283d81ccebb0d2e64a53f7b61e768f0a17433b8b75b9cb76020437cafe47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97afae93cfbdcfda8f082d414336f0c6256c3b8c46f16d1afaa8ebf20f473fdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adeab2b09a8407ad4493cd62d9dfa08004c83eed183bff7b7c32e6ccf58ffaea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a85b6b52f0ee665dc0c6d7fdd599b1b8037e7274d104eff1a231a69770d95a1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 964ad96c3ab0d6231003ac3d208b754953e6ffa7ae9a345cb3a800ef05f405e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 358d251f73e7ef6ae1c5a02c3b19a4171dfd30b7e7d2bd3ced641d83da69ee08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac7e9cc457579ecc7cb92aed1b5d4c1b35fb1fde51c981ded3f6267ad05edb90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab2020fca3f1613cfab748cf7bbfcd502976a2b1a6049e389c9d315631f0ea90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51e888b63a45444ee083b89e6f37a868806a8046ac733648141e3786af627d63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b41bd6349a6f8a82e586c15bbc0e8ae5c6e951dbc6ef14b48fcdcb62f1dd47a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11864bb4560cc0522b411d1fcaca246f52992571b25390a6fac28aa1fda638af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ee1200777d6c7c83f8e5279e40a5adcadffcd62481f572b70c11124a0bfe71c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37507a47172811b6aa6a5b3f0b5bd2ff61194745c4705a309942bac8c65ecee6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbb7d0932e8c73afa3e74df82f06e113ae8875fd5f9aadae3c0548a5bac6e79e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc4e5c9d06b4a77d0c501c631957232c46f6b8917b9cf7d83ed4e7c4a973c295
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32f98a1c019542b38ec8b9ef52385537611692054d141122446c4025beb7d23c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d4e7656831ecfeb42f475473370f6898cb343e351b530ca40cd60eb47ac37bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 121b279224f1ff4c019c5d6141f2c6a06989951e6d27fc50438ca6d68b563acb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28465b252450b35362bb3371604289e826a7c00d844b9472fb4da0979afecfbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adafd04144825d53da36c2b09fdc9fa3103354dc04adc7bce84548a56532823e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a85592fc50882eaf8cdba15ac2618f7fe687a37aa04b3cb94c899a5959106080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71e65e77a7fc74a724a4f3e1c1782dc55e321dc8866b2e25a0a5ad1fe1c7ad09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a17f47b892c6593496d4c24300d1caab6cc1d2e13fbb3a5cc47bf09bb49728bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c04949aea858cedebcff769c17111bab214e426e0c0acb5d608c97fe99596a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecd6f6eda255436377a19cc0eaec43238635a3100631a4d9800ad8c9da54cb5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7efa0eea9da7e2b2fa20f60a313caef24860c5ce17ec07b2235ae7e40d05075f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15df6ef4dc42895741fa752fbdf44f2aa5f8f2e548190375e9976d854e03dd38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04d17a18e54c00e9c933f61ad77699790ff1b8e20bdb4a5a334c5467ca276e19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73147102c165aa65919090823cbd34226cac175920feb42c5a13a4dfcb393954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d688a61aaa43654378c5584b0bdf45c7ca79ea31fd9ef6fb0adab49a92c74d40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 875d2f871ae33cb2fb741041c2301b435a86a35671f04003cf49b0612ad38049
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d531607f788e856bcd0f8ba04ae0f1cad54677724ae0d4f789bf089f93e1da56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c54b34d130fac8b6678d9aa6a4ba4375cfd3c05bee7ad7f2e74859a8d3027570
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d8f67d65b313446bda1971ca2fe335e9bec985af842466e29f7aa6a66d9207d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 237743d7d3e928f895c509ce9d360a5c751dc9449c89a2637ea657414bc04e9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08d219d740eb961cb06920a3b29dc4255d9b958d219d675d034947af2104c197
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7344e948501648ceb3052f039fe0cfe93f8cbcebd72b40f804fbfce82f2eac6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f26b1ac494a371cbf816127031620c899707a87dc4e68678ea60b941a5604543
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db8c898d2305c3f70635a6a970c232e476076e9cb1710c5c6f2d7513380b4a29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0affa6faa800e81e07b7b6f04dba29d1f6ba18e3c046c2a11310cf00b635707a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba5426e997120b098a7164b97cf641e3c769963ce70784b36f2516818161615d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42fd3a2c8fb93acb9b4653105a75686ecbc3070a6b0cb799c674fe6b894d61dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34731a54c780f4fb74c7c6a2c91ff868d9dfe184ccec1ebbde56acf348e93303
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ef8d0ad0548a5de6760a40ef1a18e4d7529d006e3d4119404ca90566e5b06a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d766add92c6afac6477aa382c532e90dd5413118f50145ed105bea7ce7425ee9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d3ca88276b79c486e807bdabe2aa446d6586a5006cf3d3fdfecb2bd60d5d3ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388c6c7c0d3b269e6580fca39523131282fd965df8b56ae7023a410bc9fa5290
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbec4aa1cc16b2e69a4a7152db17aecaaf9a960fa45f73b4e30762a046e31ff2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07c447aaec78c917bbc3d74296e8a19882e873c412d9c25739152c289653743a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24238a38fc6238a6b4a060460ee73b832affc513e7ea727407dc6d263f9890ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e7c01600f77ebc91ec23a5cb74d071841582b33285d85811eebe929e5eb6235
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3a96828c4b6dbccd5c40d583eab558adef4bd17398a07945d94260d48fccfc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4e892c848ed4b3346e485aede214d18a141e2d3d77a8dca00c0f1d5083963f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47a4af033c34d05ad8225ec3d7e2f0b291d74a579a8b9fda8072f668d5f9e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a5a7d2cd5b1e4cb6b15c4b31156271c56b8c90b4040fd59ed005cf9db4f6a6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68d2de65a2224e21877c775618722cfe447e8a198335aee81bc4816b820e0023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb794424320e4de7b7a32391cf78a0e55b80577c818af5727b5a47b522234353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1aa9197e7f006aecd5375a43fe221f54f7f888181487829bd77277a9fd94c00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17bdd752b84dc32c1efdf0d3a103d65af9a718e41fba002e1c518c2dd85ad782
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79a3ca160829716863d205c361538c68b51961976e3123d669a237a0662623db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df8e7f610fed35b8f6769ccb061e7d79fcec16d9f7df8276e27371c51678ee4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c3c9aa07928ba8080d07488d1459d1ae98598942c3a3eda372e4825ae9e7abe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c786a2d75e2c1e9dc27742f1efc2d48a9fa4fef06599ca4f6a73b285355a5171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9391714ce0000b12a9749abd96be267c90e009c23e9675b187caa516fb2e17ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d398812b550cfb6d58ee6da19c6a16fcd34ef72fe8277906bad4a1df08fb154a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36b0a91b7a76481e4766f43c8aec3a91c07826ac4e47032d8b3196eb21685e44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25cdf5aa34ea60b1373f59fdbefe3f555bd2a36ede92700c3c0bbec37138eead
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58793389439d0902500ca6f42f9114bce1e0d0837a389a408963712e4f41c17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bebbf571da405469a5c9af69adf2c9b1c57b76964978d8842c8c9ccd4e8b0ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4d854b472b693baa768d4a09a7c7f1f56ba398cd8b9ebd472556a5ca8c7ecef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3b04a6092986c8921cf4dc2b1e1a93b64c1298ff51b7ca08c3ce9997d5d3aab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d73a0100be62554bfe1711210ccb0c9cd1b56c944e49105fbd161b577552110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1670cb70008fd108ee93f371b19d2cc9047aef0ccea9fda8fa2bd700196fc844
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab0b45f9a6d66dff875990ab0e50abe8d10f1c7ef070a593864184e34549966c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c34dc7639258d3a86ca0ba45d2e0d3d7acfd3026a63706b12890f2a5ac9588e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33eaf182e4ca5ae8c99ca26a28e813efb6458b2cffebcfab8b2c9031f6802cdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 494b65c492901f387d36b4acfe74294df66258adf01a9db23931bb271bb94ac6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ee321ec60405e80c02db49e2979a4c803b39e1dada63a7c5d4e5e520d57ca20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1f7192e4007bbff539f87ce7a5b51afe10cf4d552faa622e86e2b500346a9ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dacaceaac4d5887cd2d33b3eb5698c988663aa6c37f1232a6f8687b3e0866abf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45394fd44c455d5b0202303a146f72d653a417316e86e160d05b38d8e9a6166f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6634d46d6a001272696f01446080aa5fed7f2f14189116216ed6003198b1ce52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23dfcef36ddbe6ffb18827c17a41184de122e92dec34b233ce68794b212d8227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd6914407714734763205267ecc509b05f1d35dd1ae00cfaea62684cb9c666a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58c2c419538b7cbf32c7ca72c07bf1e53fc1bdbe29277f6700ac3002b132a454
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdba43c876247f41682dc3cfa4433c9c9ff2ba5855106eafc14e9a46d0d1606a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b413d6c8d60291a4fb3df42571e6354912a763ed6a87e89467291217cf9af3fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6381962f9f9d7edd398ff2357aec19d7a38a7d46ccc77af4d4fa641003325661
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8260328a5768e7b0def79c852b4f40af60abf93dc7dcf98600a8bfb0f3115694
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/3304-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3304-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3304-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3304-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3304-8-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/3304-26-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3304-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3304-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3324-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-11-0x0000000000B40000-0x0000000000B41000-memory.dmp

            memory/3324-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-71-0x00000000038E0000-0x00000000038E1000-memory.dmp

            memory/3324-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-12-0x0000000000E00000-0x0000000000E01000-memory.dmp

            memory/3324-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-108-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4980-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4980-103-0x0000000000400000-0x000000000044E000-memory.dmp