Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 04:59

General

  • Target
    jaffacakes118_Contact Organizer Pro 2.3.exe
  • Size 287KB
  • Sample260910-fmv1eaydpe
  • SHA256 747bb69543cd1ad5c7a6fd7e5e8e5186073a0e8eea1606ebc89fe907f1aa3ed6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • VIC

C2
  • amokianer.no-ip.info:3333

Mutex
  • 55JRIBR68P17D2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    marcel86

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Contact Organizer Pro 2.3.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Contact Organizer Pro 2.3.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Contact Organizer Pro 2.3.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Contact Organizer Pro 2.3.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:564
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3324
            • C:\Program Files (x86)\install\update.exe
              "C:\Program Files (x86)\install\update.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4812
              • C:\Program Files (x86)\install\update.exe
                "C:\Program Files (x86)\install\update.exe"
                6⤵
                • Executes dropped EXE
                PID:4696
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 540
                  7⤵
                  • Program crash
                  PID:696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4696 -ip 4696
      1⤵
        PID:3176

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            update.exe

            • Path C:\Program Files (x86)\install\update.exe
            • Size 287KB
            • SHA256 747bb69543cd1ad5c7a6fd7e5e8e5186073a0e8eea1606ebc89fe907f1aa3ed6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 f745753e7793b7ada9c8d44e109f4d4dc60cf76e9892e6a7893014d86a2ba58d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 0d414427a27ecbc19f0a43aa35d4ebf144c6753ce3ff65f021f242408ede5fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4b39409350033d359c505e8a018889f1596ac3d2e72c14bbd9be328725fe58e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08d1061872889de8fb5cf57ea05c7fa159367246983776e117039db15edd58af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a431841704da5bbc5d4d80825867d7b7c08c3072d5dd625c6a33ba8a28f10e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 036ffb4c251da85a8016f726cc5541c8aec8ffde2fb13babc500a06ab169f766
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b56d51245ab896a9e5ec0f7f917ff51335e93953a3ffe1bc1e4778dc2864d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d00673264778bb77bd1516f091000f50e024a4fc71a8ae0f754ed2d919fc281d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a997a8b341c99740e8dfdca58d3c2a03bf1f0a575166200e876b5835711833ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d0a3f4f9bd6a1344ac55966b7979ae3776e53cc1afe7dd5cdf59641b9f50ed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 805a58e86836afe969c5df0963caddf218f003dfbd2792b8a3ef3b7c638946f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92c8763b93ed82e64ffdf35c1d95711eb3e1af992bc276714e7f8c509530272
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69a26fa26d44598057ec6ab715b4cab19523d787c7289f205519e1a2dc3d0b26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 645fa539185a81de52dee388e3a18f2fac1a3c0d0ca0205bf08d0648391f59f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1917cb1ee3d8435723d6f1470730fab9488bee40c01f03b0b8a3dd2eefc9a70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fca8806ab859b39a31fff886a36b702f9b0318bfa75a3c92e1a3a44bee145c77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b68fc2189c0834b389dab5dca1cc71c28111183c5d188c3bdac2521fb57ca29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fd8c3ba515ded73c1907d4ba9c9e133ebe6481e03d9b8cf22eaadca9830330c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1eb9ca4c538b92e0f63d89c135b8e07ea418c9ed9421d735ad4e5b986e2b1dfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26b891447b56e16e9ad42e4ae46c9b9204546ae5cf9de4a40e00ca58af2d38f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a5a3a9adc8b161760b7a32fec70c50ba34f0dbe5fea4cc6f3177e3d1ea39758
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75eb0e130b07bf0c7bfa130dffb0f10cdb500e47196430b19aeaf364f55225ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2db1277857d6d932599d5e82510519b2a7f150e8ee36e878b59a5fefec29e6e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d73136536bea033080205564711bab5f6e45e8672e7be3e1344051e32e013e63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58551ea11723ee66be604c36f4644fe5d4e9cb40b6e28fb17731cc037b8db739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 395ad043daa35823b638082f84b5ba40fe45d51c581a782b36c3dc13918dd3b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29de61a2e73f851e2e63f795a355c0866b6cb7d4e5695b7521025866b17649dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563ab42ac290315df8cb3a6f67a2aedf179e918848fcc682ab3aa1a594e0242b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a29ba260d22c1341b1848d73d4da893ec6402d6eeb3a7c36808cd587132c2518
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca0618d9a0a5161edd8274ae2ab540e3e7802eac39fa0dfc90b6619b18fa00ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 534a7d3f5936b0779c3a09f491884b320b538d5be88df96be8ccd42adf5ed99d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e21e2cec2ecfdf3052def9d2ae4ff974a7c50170c0bc76105060004c9a73cb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12991b639825bc929bb4e0c6cdc14b8f92e93530d3c134fee524f5e90d7e4883
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 196f9db8e7f9131949c6d30ef480882d2ec6d8b2341eb917b15072f533c8a4f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c3693c642ccea5d16242d10f0cd9455ad6990c11137a3b6edbf7a2235b53ca3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6b4a00aa56785b33fee5264138b619343a129b2f2def2416271345c5e70c89e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1c0b8e1cc53c0825c428619440d202b51d88652bcbf02307e5cf528512160d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 306670e2a51876fc193bd6bfd928d3071f9d04b5025a3f37e817e8f8bd917795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dea65265388f91d78231eb804b5b133265960898bba8e36574c91dab0f5f81ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d54ad4091cabe371987bc75b173b067f8d16431735f058a097dceb028fe9e91b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80f650f763aecaf88d1f0df93ee2d4844652f6776fb5d2f3bbfeaf8eba22d7cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19370d05da685a2cbc7dd9906db7f706cad638bb14a7f507990bd46c3a296e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f87ad398ae677b5691943789f475cf4e9c7a8411f3af9f731a5921b8230527a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba12bdf50b5efb91fea7b86175e4650f82f7841d2a0bdee28bfabbb38f53a623
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f9e10aab8de9ad40c5a564f71f9fb5a7bf0a3349cddbb26ac66ec1dd5e7a414
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0e9455a1664b4b143b7c6c693796ed930eecc386770de82e4090389c53a5a6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cb23051f77013d71afeb9745e61e80abf288d64e17116354c8db76a2e66285d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d11ec78935ef06268d436530d9953f382b6e0c96cab309476ef9e6766029117
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72512c193fc08b8c1217d480bfb32c87966a607c6e988f1f6fb67599eaeefd5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f18c56a693b959ea40ed9d23056e467763fcf940004ed0916227387304c246b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee61f226a52df003f37b081ae311a896ac3afe03f15ba3757326855f21da10d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a8feb25bc135c698f1a284cdbf3b694e8276914d131ed87fb12830450c93f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92ff7322bcf2916097fb22ba9f5d3fe078ec95573719609bd0d5424cb1efc0dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82a71253154bed8375ca4f146e77acbfb416012441de80958d53080f3bb6730f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31439fe165db948e543ddc0f582626ce1c03364901774e9ccb5ba5207499bc09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75d16d69aa342266045dd9a16805eefd2459929a29a43e72becac00938363db2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c633bf7e85a480656bd1e16cec307543614745c61700f3014b6f2e9b82194b61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e67a063c81f42545e00d955d08249a8357a101218a5c8c672ad70975615fac7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd6a959573ee83f77bd927409aae5e32a2e4d0cfb61474669d8303048a66859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a8e4a6f59ea02811554b178cfa708d99bf1f9347bfc2c72e3488c7af7761f1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9b767906c7c7adaf1932f375b26c149743199741d73fe7d7b4a55852b4b0fdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff5bd76b81f44f2c93b7bda2c07301742b5842691563ffd4f2b22560a281f23a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 713cfccd57bd979c412934b7965f5674196ef50fb0770f55f288fcc41498febc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d7902252b7f46ca7d5ce4282e3ac3e4f947c0fbb119400581db1e64fbd8b8d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1578e4ec4354f3166c36865809d4d69a6b984f2abd199e798c39f661c87bb78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3984f0c4f667c3fd5d8a23773993e667739ce41b97e04d47b703c621cef52b54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6773ef3f923e729f1cb7ebd35197ec4588a00bb2acf9f1d7c42202a17b02454
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d101a432b63b7bdf663a7c035513d055e0c01f1a5bd7fc8541c9f339fad569bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0d2a9db76f9db19fe26983ea6d24ceed8c3b831f4682419e9b1c9f1734690f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd9029b3a32a3f08806216aef8839d7168d8a572980bffd25663c8585ed849d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b23ae56ca95de2c13804954ec9cee416eff76ee55488ab283ace4deb2a3d61b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f003c3c53b6098448d68eef7de4a3f0faab0ce233021efb125ff80d50a3ff7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f612145ec0c9ee8511e88c69ce06dda17b9db129ef8c53f024138e472f89a5f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7965a2671a152788ccc197a4eb11db1b1a94986650c299fc8d19b710240b77f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66b2327702d6ed42d566733a48bd193bb321edef32c7f9895cd70ee2645235b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dd76969368f9ff48aa097f4c3f7772d4e3333ef06411368e488f4da9d67d5f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f98876b9d358150e20968efa85645ee2e9c53e68cd6e138b974450573651f7de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f2a1f903b4a641e8360cf1a70257d66a233d5549b95f2852687ce2a6951e698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14e3e03f9b50e50eaec7d410a906912061f039b8e391cc3135039d3d9ba69d93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57178728eee8d3c3e4196a88346a0f9bf626320d7fbb43c139602291928a7a24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2d7e4f8508382b810d865e267fca09f1d325383b484e336fb8f87b06bd481c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c3ca331f3ec7f1da190e73265574d26ac1d940d75c9d1b4eeb5969210741085
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c11f024f97a0ae96c154f52e5e4ba2710b7fc22d02c1919528767ac9b5ceb81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4db0a9a75bf26f1a4a19d4fea35fd950bb03053ec85a1b3af1ea2ca6533160e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97ae35f307de6d38da397efd0787b13b935ede42b27658b3827968991f7e4c09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c893cc5e353b17c1dbc288982de298a5ec38b27fcc765125465296e0fa79926
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f77ce2c34c579f53ea95c1fd2fd788902a66d7c1749a53ac3323f751c52e9ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 190857ca9c7411b2caeb672ebf208f68e0961568077fbc492d4d23a4c77063b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aff89907798c1fedec06c5fdac84de6c028bd1656f5d22774642d8222c84020
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4de1cebe12d49383a4344b59379f4a552f4dc01da5bd0c83bdbaab91b966f4c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d00f537af1fc7b7f1e30b14c5a06690be9ae070a63e6a2037816f7ffdb91117b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5e2631c17d96d676833f12723d6acf0c9304c0055f135389a308d18470cd6c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f657d16d4c9f9df013cf5d691055ea3b7c28a3b771eb91aff71f3bb8bdc0050f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b453dc5c371093eb983aa292932328d6ad354458a8063e6de54672e5f8b52ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ecd5cf33cb63f2fd066903b93dfc31fd79196ff49fcc74c2d6a227aac01848
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6011bb41475733abf75582c12ce632f423130c5a6fb7c59e4e73692186e1cda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aca917a07fa84af02ba8659ec79f51fda654481179cc311adc39828a29b49026
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ecc5dbcd0d0a88f54222bdc67c3a2b6f34acdcc33f0b9a915a849888843a585
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a79fb5f1585344a86067b8f134db14dfa0cf94e7c15ef732744d72b2a62396c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d54a410e10eca05edd684ec2abeb686577e5fb49aa601d8127fb006e33b71e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58cf5bec7512aff39000613ef5532c3ab82d64ddbf3df4959f25f4c6c5dbf03a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b74cf0ef1fb9c167842307c2f4ad7018d67edb502aaf0747c260bd77980fbcce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11582e39e2f1b7441da83a628b210e1b15cd7a4a3dcfd9569de38fd28c72ab0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a006fe2cf3882b0f2cd5d5c2de3ad83405006811dc56b7651eb8eb96c40d7e74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b142967e1cabbbd5f802476da3105946afb532af97efa02acf853702254474bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71713cfa7a0077987dbc59d7ad89509afceed6a2b18872937ea516e588bd223f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 324d217f6fd44c30bd50926723f55da831bc8347036219aa92a017e799014ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 268df8921271f060addc18ed86fb2a2095d0eb8ef164253795781279f8df0467
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c1bbd874d83ae3eee82dbfe0e8669c7e66154a42e793c11bf5fa5122cc36f43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf34bd468c24cb2adaa1e6da23d84a10920b5d9dde90d532736e856767614c58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dcfa43821f95be024a6d4d6e99af63e54a57208a66aa9d755365c0754e3ad49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 438d42511ddf7afbef61ae2d3ab306cbdd27e0c3a9746ea7a67772eb916a991f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d35525910a89e433ec86680b3204970fcc257ef28d50a7248d90ea02a1808f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88374c49c273a66875c83c0ddf5a325ac2d467651ff2b31b46c2e39b1d8419e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c930364f487f553bd170316ffdd5374db0feb061cae964c483fced8f939b76e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d884921fc77373491fa37e27ec90b05db40d4adf62eedfe4eb6786d1e7d7964
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa57107f305eb50eeb84dc10b3f5f839b461ce8a4b7f8d41ea923af87fdff128
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60fd5d32877677d9110fffedf6923edce16b1e50927d639bc8d3e299c0874cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44e4656046c1318a6c76aaf04315692d45fb7071cb2e904d18b89e3a4cb46679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3076f6021fd07a580291ca97b2a7a589859de8b033f837e634d871294fd4b342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 886bde0844a556fecc8aa877db7c2cf8e24091c35985537adf76f6e2f02d18b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00682116461f6fd234320e061afb8ad3af3787fa74f2fb69d0d80ec848cd6596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c58fc6b49022f6f50d0f51beeae11073f9d470c63c0972444bd7e658ba546cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e77379c6d0718b7776e9b588e527873cad8b9b5d47d28da90acb7c81e342d61b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98de40ccb1e11b6adf2d753f57126aacf819a0738afb7e306d86b53f3991c7a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4e3e7dfd27c30a34b8fca74cc31915951f7eb84237f5780928fc7f02719371e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b31575fa75555134882165bbb4eb59199353cfa7a9b7e5a7a44052c8f2f9962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 daa3f566d9c7c8a0315d01f347260a8bfae30740388fdb1ed341d6c01862f5dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28fc148ac19ac5b00552edc4e819acb13ca950478dccdf8cba7b29bb572cddf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ce0b9292fa52e0f15d68e962902f9a6f1ed5a6a73c2bb4b428bf3167f426ca8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb1e0f520bd770d7f5e3a78703a152205e65b66bf4b0941320594069c38056e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32efac431a6578abbdaf06c8912026e006365a857f169eb5b5ea7e8db3418a39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81a3df11b99e4e7a79016afb12f5a7c44ae52df137fa6865d304b222d128b613
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9820d2c122b969558c3efd4ebe05ba3d72b905116fb1eae8d153fa02a50a2342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be6061e74bbee40ae913a5f648a6b1e669c994bc97d32ef19b9dc6fbdcb93475
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 514e1fc2da456ec0772f3f0b09a8cd9bc5306b3def1b95f2a90042cab9385b34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d58c480db254b12c8fa234d132b884316b892c56bb1376544f4f787290644e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd61afd5335cc705084c0677c08a37da981acf5241e2619fa48a0d8a7a39b4c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 783ccafceca8f122ec2c9fe021da7d95e95f013ccf939cefe9ee94aa0fc7d63b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df205402d4a7f518ad496c02cec7db7853185475fe3f0e6a92d2e39c53ab2d95
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/564-10-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/564-7-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/564-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/564-74-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/564-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/564-67-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/564-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/564-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3324-86-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-77-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-12-0x0000000000F50000-0x0000000000F51000-memory.dmp

            memory/3324-72-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-11-0x0000000000E90000-0x0000000000E91000-memory.dmp

            memory/3324-92-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-70-0x0000000003A30000-0x0000000003A31000-memory.dmp

            memory/3324-87-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-78-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3324-75-0x00000000000B0000-0x00000000004E3000-memory.dmp

            memory/4696-101-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4696-102-0x0000000000400000-0x000000000044E000-memory.dmp