Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 04:45

General

  • Target
    jaffacakes118_FIFA World Cup 2010 Round Of 16 - Spain Vs Portugal.exe
  • Size 287KB
  • Sample260910-fdc38szzg1
  • SHA256 f8db554f62b1d68545478b578c157ed671ecbbc6928dbff2a2f02f5d438d9588
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3204
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_FIFA World Cup 2010 Round Of 16 - Spain Vs Portugal.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_FIFA World Cup 2010 Round Of 16 - Spain Vs Portugal.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_FIFA World Cup 2010 Round Of 16 - Spain Vs Portugal.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_FIFA World Cup 2010 Round Of 16 - Spain Vs Portugal.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2096
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:636
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:212
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:3696
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 532
                  7⤵
                  • Program crash
                  PID:4648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3696 -ip 3696
      1⤵
        PID:3840

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 f8db554f62b1d68545478b578c157ed671ecbbc6928dbff2a2f02f5d438d9588
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 6c86be0a45c1e6dd673355f48ed5d2e53f1a41e3fdccd8c8194d308e26280d53
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 32ce66377f3f10d7c9a02f00e9cc5c70105696460de7eb41dea709f1c8894106
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d111fb6ecdecb799f828a9cc5269493ba31398cf81eaffd635d7a11d892f8dc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a34b104710f67e52272fb9c509e7c01c9e44bdc5ad49c2f32a9e1fe80608806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e77fa4bdea3cbc6e37dd81aa301ba1f026cf6730ea4c654d087d0607b00b21d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c358a5d08166bc76a3562d1271cad925b44cce5857a6df1dfd1f342a8d2625f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18428b683f604ba0dd5ecd694e6cfe7a72722510f4ecedbc88a33e81fb80bce4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c97fb60498112856ed7236aac42e53305212997ba509e53333b5ad58109dd722
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 992a30c2ec4065410087cd41039b45e868aba5202cc7dec4090e3dd066fc5ae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfa53d432aaf34ef7645c9f3cf6364e997601747e4b2bd2657a6cee1a63a1ec7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd22d44446f331594563025d8df644d2953e53858a68103063af2f03e5a890c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5009db3b563e860880a282e2eb8415a52c6bb5368e358bc63b47cc108aecfeb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27e746443d4b482e49c6db2efc59139c7266a51b36740bf53d2d5c75c783bae6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f0451c8cdac626142dc52cfb02b20a7ff233d888f7a6116b9d47256c3e99255
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e31fbcd8240155ef429917f10146c74db6ad925bee0f10f3f99c3ba99918ee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67b0e36fd249c7fccd03eb5c44a60454ef14d29141df6e1c1148618a4178fe3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd373af422a9dc301dba7c07b797c15be4cacc20f89bd516c2aa01340c9ae80a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3ab9c3e904ce5a236a660472695bcb41cef91d0592e750fc2e01bebd2c44cc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 444c77b71cdaa8eebb6538557f39edf6bb0aea43a742b8936a5eb8266da643a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7a933b654b966a23dae78cdf7bc4e96bd5e32733e3ec1a6d282e5a72b3e2f57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 621875b5d2851092e2788d90cff309fa74a54c1b3a5e6cac05c6b504fc2a1781
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffdda2304baff4f90d2f681491cec65b223526b57ab3c894c12fb4260b51bdbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c1bab950b378e8d0f4b0300caaa0a29071d2e109e25ebdbe9a8c5e056cff45f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39404d0c3626498f81beea939c6cde4541d3d8991172dd5a6aa7c55356b6612d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32bc844fd208d6453b3e2151c2f510873183df669fee31141015429ce9ef95ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54d814d0b026147c2dcfa8b70fb5892d9efcb54020bc190d7fcc4af14317a025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4ed763e1fc33e04d7d0d1a2be82afe5b681cabcaa4166c1ff2b64fb5aa6b0b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0872d84971600b0c001ea520cbd61ff04f8d1bd76a4e53fbedd705a0664daca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24607e89dc180130111b6e6acd8d9c02a52decb381a933248bf161ff4ced39d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 822e2647c1cb9037d8c1e4bf133cbc47b5def69ff1c53a868c99b43772f9f212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b41f9201ba13eb4ccf50a859cbf06240837d0dd9a3343174b1b5ce4599df8faa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ab76690bdae8f38d4b06120c0aea2c33a0a7d977cc620f64f5807edacd5646f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e34580d64f4f7eb65930a791797be6f41ee9e1e2cf32af3b77bd729eccf8560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 682f51b61c870cd04425da20355070935b057682401a73e31b3f141d880f1dcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5a0816026ddf626f36edbb321f323c221b5d6eb8aa920dd16cf4003806b76b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1d3ab39b2133df5d771974d1da8bc8e26ed43b35ef2801ae576337f6de7a3ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 346158be2a7efff5ba939ce777faddde489972bbdd3fa0e19cc141ef3833fa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d08b7e456c5b8ea1ebfa0bf20f0840e19632eba24dd38a00fc4b661511ff31b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65242620fb256ab78837f75ec28793a2db7724e72678c9941dd2952fb68aa3cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f10d35d0e09e47cb829155c6c4229aaa4058ffa4df09846b7d9dce66de225e1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8e2cc23e377e3741f12e091003e302388def076264fbfc291cefdb6038fe4db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73c3401ff0612d87d72760bb29d77cb747378fe3daa3e77c71d8243adab37054
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9a50bc701982dab9bdf0a3bb7a0e23aceb1966c69211a7e1b30e1e5ee703aa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec82eb484444b4e98f1db7628e908eecc92d6dc5ebaaed7addcc4e5560117dbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dfb9b8f3c4e75d01af9e392c8c8c63c5c819001012d044ade0473eab681b2a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7115f70f14ecdb64eaab3fbb5e4e665ddceca05272803928163e2642791bbcc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc55f8793c400daad0c07d4ba83acc995dcfb9341ea6370fdbd2d930d8834cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c711237ec6d435d93781b08cfdff1468250c218417c5c1449066289b61bf3f49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e7284936ad56d9577964aec93a4a7a7412b0a983185e152f6851a3de0cd7496
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6e5ae0958d57cad8a5ef8628cb4cd672e933d99cdc457a1ecb1509129a5054f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 992aae316ddb40582477bf93d863af692a997c0cc004919162885cca97559502
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1fd328e0b9720747c2d078a6ea7000706a5053a2723a9150818b34cdc55f896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6963153c991e61396410e97c35344259049a96656673b533bcadfe218a3b0a16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5e851994749b3c6d43eed056e276a36235b1e0444ae1e6f49138ea69b518b26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7ea32bbc742f37da5eaac06b774c387dfa1b0bbaafbb0a8d497e661afebc9fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1201a72a8d92f616482712c516442444ca52ab3733e388b05c8c69e5d66e70b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1edffa7aa471e138df316d53dc1b5874dbd5b78d945577dfb916fee53ae0e37c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f8df5914418bf608d36f4a79f063f6261f2fa18579bea78a563b4d67310e4f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4c9775b41ce0de932c9c6b8ec0a609f6390c0037e7fda54add2afbbb082d5f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52f5a33a3055569d656b83958853e215d2e6e08fcd0d2961e5d7a4c7f9cac0a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34e6d19fbb369b7317d9ea230fb024ff54c984e9fdd75995dd09d090bedbc0b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e9c666a99a5e47ef7350a38848925ab3ceec941ec5c598efa338313957b06c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7d9dfab4b38b5f552e380153d6f3c6ff62762710b7b1bdccc241f79ea9c6cf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f853bd126ea4835fa67a399d01b362f81fcae3d85fdf2304ddf45c6dc7099523
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98074422bccf341693471504fb9360d658d609b2577799705d047068aac0dec9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 098035ba165fdb933f64b81260d2a7179f354e56ac89911ea54eeff0ea1caec6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d9c6c6707f0252a7797b80e8775dbf728ece27e36d527708362d190f1fba8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e216ef62bbc38209a1a9ca724bc2941f104f4c759f461aef78a4e65705f6069e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 557d348582b76b54d6fe7c6e21ef1fdaa7d75838a9ff806c8ae3fd7c1202a062
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a76b976f415a8b95a80d6e25760171c86ea865a1e950708b6f3c068150d519e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02dcc6525d3c022b3376847477c7de2a1eed8bd2e5e6c8735a76d65de13187ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2118f585a3e74145c5a36132bb5c9565d5550ef324c9372f8555ecdde5c49ab3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3f43a58a4e3953b3de7f6b6fd3c7b38ef6e6a163995fabb904b7adcb88290d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f65f2810e5bd1219a8f2477fb69c8e92f65ed88dc6b4aef20b3c8eb22a0ebbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba4a7b7f13d0da31328dea294dd24f703d39145636a0b3bdabdafc8ba14b0897
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 514013e98163e6812d6c87dfa0fb51786837f4985741fd8340aee9e97915f78c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f553f220cfe0737256c314cbf7d2080a8deb0485ba61c3516192c9c07d1ff0e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec79cb66c63b81bb9854cbc9368d66f65f8a509e0f53de5a510c1f663cd44f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ac9bafa395b4324784d91a3209dfb87b7e2a33877e21cd17d59f9fe938c6950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b903dabdb6f7bfb3be35dd63323068b66970871b9d70d3bf08f272b1773dcebf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee7a3c6600271306f4cd0c01eec35564e32983a6c493bda8d58c8aa82a6bef09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca777329226dfa9af1bfed7dcb9ef4800d6bb530e59daa8de6d7dfa12eddd2e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a817d41db258ebc1640127a25181a6f9a6c8db3ddd8930b4fc50680b10a4a2c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65dda3a68808fa90bc8734afdf4b0fcb5f157c3d5e1a088bb718ab447f9075bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36629dd38c1c61868890f17e86d2cfe7832955ede2290d4eae0bbe4ecc90aba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec5f38ee78a21118f78f349389f786c77e99e86cb80e2f7c80933b4adb32f0c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecc4d246a9e1f2aa4888fee967fe9bef5d07f71fa1bf977e2620909e879e278c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b31b47ecc60dcdff8b3509b025c00c9d82a525f9c39432d716fc5847af82f5bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c05f12d81e7b02560db961f7941e200a977208da6309a636884ef8af8d4f94da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f728ccda9f62e610fda67c81add1959dd6456306faf4f81469d2f0b5302a217e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd9748f646a64bb07fb923961db19e32801070f368ebee7668cc74f64761677b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6ed360ff9715e36fa23fe7e130348e557ea8fdc412cf8cd94edb54e93e758b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd4e6b074de55775decbd21e2acfea2f0a09dbdae9e7186be22689b474ca68c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e206b390b4c5a6e5e8bad2e79ad58c3cd801825483e02023e8345c94f0ac9356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be528d6efc0a1c271a4fd5419241749644e0ce9397c4c7cdbc1d28cb00f19d98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37ad1c028c6c794895d55b24cac87582853b315a2172f08ed8e660ae2da7940b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4755e27fb1fe88749c7d80e69ec20f62228a292937c38b43a4cafebf6419440
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8124add3574ad92434e89459a7b2c41971b7123e8d95900ba423ccaa00dd5507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dff74d1160d6b520eb76dc41305cdd15cfc90d1194b9e8e91672b8d41982594b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e044f5d6a0798fae42e711c76480d2f07e0fcb276261bdf279ea3df07eb8522
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59e0b93884190dc8af200449da92103738dc8340316ebdf4c3a631b6af74ef7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb65dae07eab1366d1984f8ad7e153b756c52062b2dc4cc09f1b20b2803f0129
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b367f5a6049d0b985931a3d8cb88e8c0a68e6f0dba12bba60d2033860ea5ae9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cab29b0f2ce9fa86277e00e3ea71dbf1ef1d80c9ec0931116caa27db33a122a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04fecf6ca8c69874ed1c4b88dd9d0b00859a1aa4dbb3676c63ce1691a0263f89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60c939e18d6efbc8ae90273670c020fe66ccbfe4d6f87b408a32de5bed3b1888
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1edd97658e8ff3048f3d7e5a412ec07ae2b9ba39aad0f4dc189e69ad4c4150af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4779db59e3f411c4eceacc9bdc09e8d7d31da395d0b3586a7345c2eabee3192
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdc4235c5042b7bda1f708bb0f2a6ec16d1c527f6f301e0012fa768c6f1645c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b10e01c24d0ca4371fe7444827c40236fee6f0d53688f5d53fdc126f0e1db97b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df4764d72dfb000238c06907b4cb14ecd4e942789e7bd61cdbbc382c1b91c33d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90f1af525de96b9ef8d634628e772eeff9744a5259f1d29353ff453d128c4e98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8502941b1e515ad397baab0b4e8973a1e6185b24edbd6fb6faa2d0ed85a5982d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e47d5f2da655c1eee9dac0b7ab201aeac9f31a47a659455fc0be9cc15601566
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f268aef90ca1e0e988460998a7d66b10aa9135480fda46b75a2d588a292b1a73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 086d55abb1b6a08cf215b1c620264b686c4994d98df48f6f3babce0716bb7d0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e874b5308bfe9f730c41e6825802fda91a260dbee6fc1bf040002bcecf382c81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc5afbc91dac7a4ada3ebf3c2791f421319d851b69ba6bbe3168406e298368dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e7683b4e73e17e379e575684294fb01e2a8444a286db227942a520161cfe143
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5b21d551601cb6efafc88dd75b75925253d87aa1b35b80203fe19730b57fe81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16b9645ffb964562366e00db69b9fd0e48786390ccf8008f2169b415bc85327c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14ab3aa42925813eec7483631208efe76781876a0302544877922424c28e3078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e34829467789e5882aa42dc5a1d50546d8c183bdf386b0e3b9a4f5323875ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9979233b0d12aa4e428222a73b046eea8752bfc46e878d4bed39916f96ed58c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f46079938ea6d7ee4f0085aa1e7b98ea042616127930466c8100453edbd9dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d14609272c3d84a228d5180f79fc66693b48e507a0579d468d378057d5e668f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d045bf30e9d4d03b9b21fc42c9c40ba85682fa8b19fdf26060c5ac2fc3ecffc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 639682369414dae9c6c60592aa16197cf7f3f48dfc37660d28975b678351b6c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5767cc0f8d2854f39264e00c5bb7b98b47299c1b4308553f4fbda5b3331687c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475b077375de9139243837f05a92ed1bef79f5d65a1379395a0c1f7056186029
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa22a6b0adca8ea2e3755674c2d8743d61f6fe5986fc02ac6d6d40cf2caa71e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9acc95e353ed24d9f7be248817b6587d5e398cbfb29539de34daa0083e72112
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15df44d762724db36f8f4b62758e9d00d709b90ef5e6b279b311d1071d643743
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4de1a1380de1e7636f52ce2f573f6f0262313f7477d301c63edd3780a4d80f47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f6f4e4b8b32a3a20dabf357e7071db2380054550491d3737f837112ec5e6b75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddd9b01178d96d92f10113865414c8d0653e13bac287414ae97762019052940a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e89b18c029865c304a2764b6f5461d8e5990a118e474451affa34754c1bc420
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 826dfd14f26ce6e59b68113347fae3aa342aae56d4cac436c8dd18e50bc55841
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 509b4e0aaab394d04b5b9eac363fa4d1ab39673eb6407688ad0cb10782582b38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a2627ae19f3bc8d058abd6a33fbaefab91509ca6dfa22a1374fb6c8deea9025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa31ed12d3a670a278d62dc9e95490b6c4247b4d7583c3907b9ad541fa0f871e
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/636-88-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-12-0x0000000000A20000-0x0000000000A21000-memory.dmp

            memory/636-73-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-76-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-71-0x00000000039D0000-0x00000000039D1000-memory.dmp

            memory/636-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-11-0x00000000007E0000-0x00000000007E1000-memory.dmp

            memory/636-93-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-108-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/636-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2096-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-75-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-25-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2096-6-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/2096-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-68-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3696-102-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3696-103-0x0000000000400000-0x000000000044E000-memory.dmp