Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 04:20

General

  • Target
    jaffacakes118_Friday Night Lights - S04E09.exe
  • Size 287KB
  • Sample260910-ex4vmaxdqb
  • SHA256 770ba5fbc5dad68f34debfaecf6d9e51dc6135c312360a5aef5cd348649b3f47
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3128
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Friday Night Lights - S04E09.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Friday Night Lights - S04E09.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Friday Night Lights - S04E09.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Friday Night Lights - S04E09.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4472
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:3500
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 540
                  7⤵
                  • Program crash
                  PID:796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3500 -ip 3500
      1⤵
        PID:636

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 770ba5fbc5dad68f34debfaecf6d9e51dc6135c312360a5aef5cd348649b3f47
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 054764f1b0a23b920b7864799cd55f20ca9e4a0f5e30f276164c5801ac65d0d8
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 3f02cc1bd5ccfce6b8619725b7ec7b87cf4b45228d3521784f4a42bd2ad4313c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 210cf4ba64138b8f951a89250b3c51831f86a82d28aa7d81bb44ff3f9bc2d094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9070fca132169d18e9a5ae71794568027a2fd7f44944f95dff54a08c41ea7ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a52350ffc559ac893b01cd1ded42887284ef8c22bca13cbc982a839af0eababc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c3f74297b7a0959edb8f876586649f30d6540186f1dea7c3f5983c9477574d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ef2954c6e4f3a9e85d4d7c5b608a16970b31b3a9e7b8620f8e2c8f821abb978
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba6c79d8fbc65ae9229c7dd6b486f9dcfea854bc2b0b0d87b7dd3508e8266b53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7a5feb0cad4c61f1502c4c5e71146320ab627f45a2792418b3a411f2b6fab1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a890af23f14d3e8e192650818cb9bbdecbf7587701364ce75d25e236757cd1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc86f971f2f21a21c7d397f61781f550aa58e9ee8f8b919b1bfb16375df7a932
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82689ce046b3afbc7f1d02fa2f0b7e4547f17f8b587c1b4c13e3fb46f13ebe97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8af97537ab74c8914ec68ff0d0f1dc92edb1f2c30cff9d4185cd4fbcc4e96a2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f7be95a67acb0789cfbf0e33d28e14a43e9658e4e65fa61fc01a326cb5df8be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf1973127bfbca8bc4620f5298f2a57da1c7fc869ae9573be9d40a4ee7c7af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5bb34d2445dd00db5b6094b98451261abe3dba8b30c75e8298b932b5404510e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3164744e5206ab14c1394458168f5356696507174ac5cc46ef3956d3815bfb35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00bcc75a2ea16578b18bf8b326707ec4fdd2d032481fcc637cf8eaa3cb691e83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a81fc45c3a6b2b52dbfcef099958b64dba64306ae103e1c2328a516d20af8a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11b5b855d84fc2199d10c83009808be8ca3c1ba16c258f15774848c558c9a966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c30820f0cf62eebdb57725e401f1d66a009d0224523a69757f46973d71de541f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5d0e0cf1ebb3c3e6454ef8ec95458629a7b722b0670033790d45d7896370d20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b701782ff7ffac0e01bcee3db421460a500babe29b5a79e2049f790ca55fd14d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a18e3d9761e9b6c5e08b6a6939ed638d3d7b410a49672e4b4ef516e0a5145378
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d350c572982206bb9af1b2dad8ab58efe3a7e82d3508a9827beceb520b5f15a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21fc18b0223bad2ee7515688279217a8510f8cdd61fb68f5443b2b9e0a75517d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c72cd848cc75cf9aa470acbdf842a8d1446551716b407b53a19e69c931598f8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb24c3b2d0dcb5312fda9a8e85a67884e8dc1dcbf8d9f60699e5d5b1f820937d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94d50a76acd69a77958700d9822b3362ebcf1763b80363457a1301a50a11db59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52f16159d3e7c8981f02f70904089753b02da9bc8487d328c94e5612258a2b78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bb4f9d43fd52ddbd098eb1a89591d9818183e5596b0c257291c3973f8000cd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fc66e5e587a3bb975a26ca5e42b2b6fee66117058c437f666906c18f3018d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5560fdd4187248a573e325045de3fcdd7d5eb8a77660bc43d3550c20cac506f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b13aa2b560182dcfe6d8308ee0abf870c6be18b28aed7cd413a09547a9264ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc9be7b86814ed976251520fab951366132537255563c0576796b1a6e5cafc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd7d0ecd8d93d91695e7331dd1599e387a5f47de93841e0a1eaf4f1660171872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf957d70fd5c7261d2c19793dcebb3d85ba35625401c412dc59e887562c1c7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47efd734bac0beba4c6f9d7c39b6f5aa6e855168f27404b1c6cd53ae4c8c2ac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b0de684407d70adc936f91352d0b0ed3708bfbe630cf7c5eb274794c9f8842c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efd9610f8c05bd31cb347338379695e6bbcb1477cd7848c82bedc8836325901b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 039324c893bcd0321b1aa59759438f911ead10e955a226958f3d09e25a6812b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b5d6a0647d26039f9ce61e26deed64a5a44c712ff7fdb7f620d066ce152449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee03da9b2e99bfe71cf5d8b23854416d8f619aa5c49e22564be3bc3df91e470
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb78d0502fb8ef8910308c3d29657f3876fc8410f682bd3e7542765d01297a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e710fdbe2945457a0bbd59d2a58da074dc02e7da39328e35db47038f2fae01b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be82184d2e4425b69bba751d056e8e71cf52e879d1063c67ae40005a297cbc2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5e84c83758e241e84094e65b791ddffbe95c36dee16fa710013f4f37474ea0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae9af6acce0121f76f55f5b3e5e8c8ae5507e15783ee02df57d97b9828d3f33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f0f5ed25caa3f8346f4b5bb2787ce126593dc5012938503e6a4d9bfecf97e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0739cec6e4c5899c5909c02a84c3942fdf479d429f8e6fcb03c126c0d7b273ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee0e1975b9c60f61085ed6ebade2781974e37d90e39b796f87394a71c6f96313
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d937439d72724a2ea3738993542c4af8afacd8d993f6567914d47d643ebf734d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95ee8f147fb2de9a4bb9d4c968ebdeb1e6884901577d419d695e8f398bffc3d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27b132eb7461743dcef431c59f86433b66ad34bbafe6509bbd393c6d6f1b4fa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e56d0f642b5339accf340e2e2bf9b2f3e70b34932f0efc6314e7ad08276d3ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93d2d4e9eb73422ffa9d9ce106de2bdcf9c4b579645ebbc1cc0d0cb9d17945aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7defb5964dd22071301f5d6e993615d22db2df8813cfb11cac333b288248eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8cde12341081bf1a23a1d3dff33e44307eceedb4ee9c72ec5cbe5f6c25656be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1055af41d8c1a46e584f8fc9efa7b1cf3e32030376ef9f8f9031a79515ee39a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3805fa322d00e98d8907dd0a41b1a37542e7f9a659381918526c8b943cd5823
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42aa50ca009608e309bdc3767f870063b3e37fca24c951369cf1a9bc2e25212a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57eccb8558acdb81ba015d118db289ef7952fa9654157dce094c26cd617f91af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 301c67c25571833609411b4d77fb898ee3de1736f5979c7e0b5feacc71a1f071
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8e8673f6ace747443053f6f6e7cb403edbd3038c02b2d6776050c984ab47c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ffa63389fdad82c59b74a28859457d4a1d6d33daecceeba1c30c1c89ca4e131
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45b0e34deeab8751e699507d62186e635fbf779eac53ab7297f0be260480863d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e559c658248cf68db2b0a38a1cb17166ecdbf06c82f5eb5685c3653fb86a7d84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 973a048d82a05803ad01b6f3a7a7d7f6a1b76d4316c7119a11275c8358f44962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edb751d566e355f6450d8ca1b88041cfd2847632c5eed4ff1fe22454c9c88a94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a08ae8f3c9b7f6d910a07e7ca502a166530de8d5afd544dbfc96a07cdc66035c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b9a23a61acc7637a5f02087c2f6673f5b5967aa93a147d7b00b470c3a345a82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4049ee4e6eb9f5c98aedd04eecc5820d01726fa6a25f83ba5a2f08c773b4fae8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b66e620a63a6f1a69a80ea05b3ee247b1ab8fc30fdb33661f2fd6fa2cef37b64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04eba37ed34a2360a20c8b088ba31ba954671d02988741227c98f122f4c3a1e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb8a8b456d03cd916a757ab4220abdd15ca8a639aac9200b7badc2515dafb4ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b60796e8ec4265a79ba18beb5edc680cad729e43686311217811c3339b74e52f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f86708f2036e6bfdabeaec5bb34035cdecd7983ac74b56d0d92c6a193964c46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e2581c63ea852ef924506f40e2a26f02171241801394ec17d88ac17dc5f5df7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 952eb670526cb98c1deb25868dcae9fd8c023a4039eb29f8fbff5da8caa98b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c36c659c9bc1a7f3e718e2728f9c04945db0e711ce71ac20d41fe21fb661c37d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 354e856e6188e7bd641e112f161788d21e9a0653e9eee39f4421561d6e9b2022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8be12d1e0c78555aa8cab8b776d3a7eed2832aa3be7efe31aaebdaf3b697f13c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b98b2387b4e461b91cff59227f41d0aced347b6026d3840599ea560e650f46d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a59eff275d04611e2db180675dd69ca322375e3731e4d3730cb590f3d95da37f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b13334df9cfbbf28861250328e2f0c2c38fd9a969c47ee4a0f86997f8ab0dfc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0b50c0ec2af244591814eb68ebacdf3de8ac606914491055267c1a2adcb2c28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 241d9c5d182d592460c2b846e0c6c15d59f4aa42e6b08bf31d1f050aa17eb897
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0fa4cccf38ad544cbf0c94b2fb9a7696cd690e4639396a3121435f17b33ebd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8d3b0bd7178d86dbc85ed008d50cbbc4cc54ecefe18208545d785834e3441fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d340095db10a4713ef2ee819fab8929aaf945770ea13190894587ff245f1e01b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfd60208fedb6cba4299c691bdce325f470951bc67691efdf78f4445df4d9535
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1abcaa62e5b42c0d9fcf3bc1db1bca16016ec8086f411769c7d560a87208ad12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15d36abfed9f78ce628054b273a011b8ad73410e49fceaca653fa5004bb0dbf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab0b2c1371bf5408897ead611b48179d6a32e1f4eb55d6cbf30d2d5fe8ed909d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba49762212c4db5f5c5fd873efc2f8f08d0142467ed42363933542ab48aa3881
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93a6f43244ffe8b140a6fd3ac2d7e06bea3af1db2617830dbfb9143e82a56167
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b76ad297ead0e0fe0b44aed31074910e86809b26f8d02037ad526442e451a793
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac13d7875f29865d0dcababd81cd1094cfa5034da524ad94dfe611c318868eac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ff7a7cadd1150f91b43079730803bccdc22ee062db75b723bcfa1aa210b3d02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91784ecd401ccb58e2d1a9ddb1eeaea9ad49ceea56ad7968bda4d0fc5b7cd183
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cc539c4ef380444feca97652360d9f9cc1f1de17bc1fc8d74734e24778ff0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f69ac35fd10df6b7dd292ee9f1106b7959bff1b1770ce3da372e2bda1f8d4d2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cf14f363e04dad1b08e004131e19840122ec57fe4fbb73b47c1fc9c408ae15a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 647b9644220b085158adcfcadca18439e821681716ee414949a347bdf45d07d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd78b23964ca872f42151f4357c501eb932f1ae445e9e6a09360cf1dbe9c921f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 818f5ec970f6fa5537c83dcf2009f01bdcb353d5081bf743610d4967241e526a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0763f84a6a369aebd2eef33588fbd85a6bbcad0a917f1e3f33566591addbe09f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3daa16bbed99f287db0e735c9fd67bbfa2039bd0815d67f1c8ef1b0c3186eb59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 447c7c29b0c27bc76a547db2aa13841533cdc70f3e6b0c7c22cd9b73e22ed3d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5dab87105f7442a807be7b2d403821d87152c4a088a9fbbdb358d95f933f387
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb708e3cd29c129c3b950ae2c635973c212d91dcd94f300ce95edfd7665eb36d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26fb0927d1cc85723197321a22c89c0f5f1bdfb6baa04d11f33ae89ca08622e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1bcb4beeccc8a7484322f35a6ceb0fff466c749275cdd6cb5ab7660838f475a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad2a5ab4c1bdef4545986f1f750d3a4c873d4ac0d2358776c33e2030f645e72a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d0b3bb527e06637f1909eb8729a46e445b8dd48dc90a8b7d3a802ca4ad2eb1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46a68f0c379ef6e596be91fc991fb61a799274cda1f36c6fc1eaa8d2820cb363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4d6cc16d98034f60f650697ef7d75b8f2790a84b6ec577e257173afb6c34057
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e8df5b1b9681a39eeb5c1960737f01bc9dd2adbbd89ba6dfb736ea4b0f44304
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 954f672bd4dcb1f7605aa95575968362daa2bf660a6743c666a48c756c2d4fd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce493eab974b1c6a41a139e58ff00e6aa00e2927f01a477e13a7b9c71d1073cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0584bb2b6219c4dab0d5d6e0e88531bec4a315781135cacc0c264ff9834a4caa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13822befad08b9c4e76552b5a5d9eeb627d72b191caace939025145e472bee62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc238dba5899c90f97813e1e294dadbd37684a270c81b81b67039b0e02776253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97c7c95ff0221ad4efdebb0805b9bc1e19947b26007b4429aa77f99dcc70c38a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a53af439e5bf30585e83db5f845e240698bde48c00e23d4ee487f61e5a685391
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76ce83315c7f9098de328da674a2cdcfdad29ff4740cd21fea122d95d25c18d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09274f56da6a07c833971af18d45bf4823e0104231b76b1a1a6791f82da6a844
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a639f9aa9cc1e47f3c9966b683eb9b1816f2176ff73923f077a75d2e77d07774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bfdaee6d6da78837a866cb476736218858446e09bffe796bc2042910640e3e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18ac6f12cfa0a682e0cf0a589e82c7a7e8c9ef91f23fba4996629beda1102a28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f22d9b354719f7617fff7796cc3c7199df3fb5a5feca32c1f7252212bef0227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8ccbe11b5e9e9bb6bef17b691da38d2d66a6fcfdc5d4c76d63e6148a13b625d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d31b673bce463f2e648edac6ddab2dced29af8f60c59c698f7cb3afb4e261351
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1814f45efdfd32e3ef90867ea7af1e75bc55d9205e9218cfc3489b38adb20ac9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d49002e91977a435c682a5f1bd779ce916004f4cd7b7ae5ba4e32156d20d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 937749902f4889869c5cd5a4d4fd0384ce518a03645dfe49424ac54790f80aaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8573365830d3ec4864cc3f1968e2a0bd27581c71d4817b9259f0626646fdd56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fed6faf470f0a08537360de7001f2b770c0ddabb350868649b2de9e6c68feef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eaa4aec286a946f90a981a357a451730cb06ec7d15edf41abde9f2e19b22d0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f239232f76fbe9fa19c21575e1d0eec3a1a3b20c5d1ef7188a02a738c296c5b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bae6fb2b2ac97c9fdb0cd049679f42be2bede1b79cda400a7c9c66451ce9e0d6
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/2780-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-72-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-8-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/2780-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2780-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3500-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3500-101-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/5052-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-11-0x0000000001430000-0x0000000001431000-memory.dmp

            memory/5052-75-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-12-0x00000000014F0000-0x00000000014F1000-memory.dmp

            memory/5052-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-71-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

            memory/5052-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5052-107-0x0000000010480000-0x00000000104E1000-memory.dmp