Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 17:38

General

  • Target
    jaffacakes118_Trojan.Win32.Llac.laan.exe
  • Size 384KB
  • Sample261006-v7prfsd18l
  • SHA256 5d9e8774334f832b639df3f7837e816de80b937092abdcac621ecee9c6004e0b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • remote

C2
  • huscool.no-ip.org:82

Mutex
  • D77N6EK21WQ001

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops file in System32 directory 1 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:5080
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:3864
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:3028
          • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe
            "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe"
            3⤵
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3752
            • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe
              "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.laan.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3340
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 632
                5⤵
                • Program crash
                PID:888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3340 -ip 3340
        1⤵
          PID:5232

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 fec75373f0038b4d1e1a2d15bfada15e27d6885751014bb6ff57a8c6cfe2e382
              • MD5 SHA1 SHA512

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d1e1413991760b09f860fcfbe03bb809a91b955b3db00ef99588beeb5781da5e
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 222KB
              • SHA256 301171ab97bd9b17f0334c79a6b395f8cf2c96c679910968f83380da69100d62
              • MD5 SHA1 SHA512 SSDEEP TLSH

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64f32b5a95609aecfb5523dd029db979bc5b8212999f7cc127d912814cc22758
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42e4226a6abd939dfe7f149199c1e2b843d52e06e3226cfe6b09b0e5763891c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e7259a0e3263c7915e21f03781cba1af4501b9798121ac8692448279baa0ff4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f1e7669ded6123a0ca1061bc66983d5c38cbd928b9a705871efb3608efe7312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c55642586159ed203b83b1ecc097445114bb387dda8f45df3b47c1316662fda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d235b07fffbd280fe991bbc631ecc3ff3cff11e8400dec5e5bb6a8e63fc05d31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d908b136e7e1696472aaf2230bcfcb0ba433abc8ee0bc0f1598761c6f02d8467
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0b7c6030f27ef9ad646f5bce18136399e3bb3630da6075696b127219fd4d9ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c832b43dce0806c55ae7b84311487b2abbaf779e01ceaec983ee56f6e493160
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d917dccef7c3b49ae21ce24faf82793d3f08199be21063be2671bc213324f1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cb1a2b7d84e16f0eaff671a47dda1e14d20e2e6cc7f703c33c032e8453e6f16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff35d9f964bafa3ef5f6d9836ba709b30fd1dd819a1f87abe9f95c73660d6328
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a73bbe4fea0798e8c2d601a914d1f50b60a0bcf4df8cc777458aa8c7b24db03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fcceb1c89a0a922deff4f975251253f1e6d0e17e051faadfe794128bc194ccd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 167098ffa5ea6f47c08e1fec1e89f10afb48b29291e35d669f6e987120fa5b19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27f480c996fe492c66bca5c76cb26e59a9b7c6ec0201ebd1a49da1362bfaa063
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1be34270b09708ca4850c29c9854cba27cacc99c4aebb4330444b236f02129de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53d8d0a96c7347edd6ebc64442ef4bb23cfe3580d8128198b4be140095e20b15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74cdb89c7b7fd0ea50916857f47aec11dfef0c2f7c6b278bf87df2e18fdefda1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d5d4302f3e2ba639e00f6428d230fb2bdf01404d846e54d822805c49239a913
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee8d5f0d9dabd5c93067476a15da5101e7405a14dfdd1c3f86927cd27b23c6f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b02020329c8de123c23314c7f5fa0930c6ab3450922f9a87982e57465ff2075
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b188ba2aaf2bf90c97576ecb7fee9303902e811235af8d3fa0ec655f654cacbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b491891083d72cb3e731f8c7afc1317830569b34afb3b99fdda265cf29eae910
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 691b8e6ff7fe29afe439a70892e2ce8fc5d5eef1027b7c00d8e8659a3695c8aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59678503a7358ba9eb3a73171fe01a487353ca4b3e1d0810a5d6671782ae7983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faef6c6236dc575d1144d0a5c7658a7f0ab9626046cb5eb8a8451ff5eb92c22c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05e79f83e4bb72a475b3f98b84e139cc26c0d7f46ebee90b03cbfc1f45d50a15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b399b419d7e0fe1dc35c90b2435b0a6d4133a527a8000300f8d867a9e88bceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7bca40449c54dacbad578570e0b7d366882c61cfd92d8a5719a09ff2ab2aae8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4459e7dade8da70a142d4d5d0ba991a2eaf0372998f3b110ec450f9e6422e291
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0f9827e53d06c703c253ba5a2000531ee813fd89ca4d33891457841c99ab6c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 382f5cec0bff12dd7cd362dd7142c0dc9bde72907647fb46e10116e33fe761f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 300f3254452d6b6cad9f06c1460e8e2d31b63109008891332afae7b09086f58e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 278256008d3797b4b97b452874807edbdaf64fe6d5586954d7cb4435780dc344
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a30014563878c1b8da1e4fca62a7e20d41c4269394ad09a06d4a4587825f2c14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c7808015c27c19e03fd89e7454fcc962707589dbf32deeba5b926dc3d653c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e84db527e23bb39161f6747ad0ef9898aee9961e8851d9c655214fd4da65c7fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d088ad5e7b275772456765ed669edbb6f3fa0030973fa9c305849ef84dedf751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16955e095daaf23f43b74da4946894599f7c860ec626c05cae26f62b28c16c2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f914da84a822b65e851d059e14b43946126b300d806724ed34658fb42b098631
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81275eafd47dc4342bcd9db12475cefc53b1a4b9e9bc67ea54e77b7644820786
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6db45817b1c3d4bd35a6d3167e7cf9664d6f4ecf91bb28c0e53dbcbc01d5948
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46c339c6fdb02865124ffcedd7cab6e476b9119e1c00a077214c3879599e6452
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 622ff0da88d92f35705fcc89879d7f6a38648921ad96230cc84f76c0f0b0bdfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e38068301fb9c43a54de0e0d19fe3b49c8feb10942e24c84f0b07ee9201fd31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68d4bd7c02512ff5d45ea7bf80f267b6e96297992fc79b771d4a9cd6fc85931a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3302dd5f37f1d0dbc1ffcffc12ba288a5d0c4dbe6e8c8bfca4ecdb3c078aebbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f99a8125c007bc881e1b346646ca71917ca8548401f6a9123e566fceadbcb3b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6be699f562cfa967c40aa55387a592e2bc48815fdcff1b4ca81f55a1851ccf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f6e432d59b32e7132d6c82ffb1e5293a579b2a41be99f59ea865ec39ce0e878
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5faa88a0fd110799d109fe78db4e793130edb3f36d217d6c8aaf22f0e6f99b55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e17c1a9512c71756db9e8fd08795b2eb7b1bb594f902b25e632a2f5ac5b533c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ba600c40e3e225bc5d01cf60fd82421698d091742d73a880c988ee6865a4d82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4444a65cf14388a567eb63f434354abad4b17a700381637741eee9c60728451
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e517ef88a552260965a7f69195e7b9bfc58d3ce55991c6779745e41485fe146
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 959a342a6b1671acb21c09d1ae75c8adfa58aaf627b6faa963a319d9909b0a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ca99e22ebe909fbf3202bbcbba381d0b84f2fc44c277a6c791abefdc36b0efc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6127ff2235c10fd38ab7a1affecb7e13ecadcae1414920ff0e262853dd74fb41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17485445ab7a3535446287c68006310d7399b2d863301b505523660b1944afd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 981718fdbef0a994f4b083266a13ad16e55fe0ece0025e0a9184e847e29ee44b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73041f4f809b4739fb48ef4e6703fc55d8c4991d4bd12083411275435171cce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a154ec1d97edf4a9e24ef9f2a4e36f5852e997b2b59aa3c04042de448c32112
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30174bed145115787e252c00558eaa2c63ee02339a31aea6da7ba7f92c1a1203
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 303bc933b295fa88963c70c808677edd64de491068b9ad37c61a146bfeefe765
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9250aa3225605711f13042cde29b3ea83fcf44106d5775d436a757be2a5e9335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a32e2a4e39c5d427f1af2fee06de14500cae6d1dd86b29ff3b40e3941703fb11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63e4c46558c85fd11d6b9e9814809b9b89db5bc6ef6e2f43867d92409684bc21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2b1acedaa48fa1a30055ef901e2ac9adf560aa2d72b880106baf0785d8ef6e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ef3f782de48c1d31e08774f8a24324866097421102fec1cd3e92248217cb23c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 644d911a8b784323eef7bf0bebf8cdd09be4cce19cdec498f10847af7fe981c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbb822b79d15f13555a3cc0649b66fb4420c120133739f61ee2f87f765c49545
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72bc3c80f8a6f337752f24a18a9a9747fdfeb14801b2a1754b32bc0128a8fb35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 307c70e80a54945beb7223c437dea6a41889e0fff2473b6ced4b21870f7d2f13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bad6351d88aad10fc120371df73b6b2ac17e9ac6b7b9698bd66e60ac0db81eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e65c7b42a85bc92dac424e44efeb9887c53380916322597b0019a7380ab6892b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ededa902cd19a30cc13bb796c91d898553b085fad33f2c2d33b6b37cf253c87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 164e654e2566b7b8dc923d8123df199b445bde12b7830a9b3aa77af8c9bed21d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e5e4f5aaf6a8862c6bde8a7252bf9c5e1adbe2badf601e3cc61dc538fe76276
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 687192d71ecdf7a67ffacf3b66c8a72e60388945e79ec6b12d0b3abd2156fda8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e2ce159b9237c6d5cd14d2100abab59cc112bcaca4a0814bf3adda5935d425a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e10ce930859a47bef58da539ff313bde4a23caed8d7d9253e3031ab43aad6916
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab155195d07bd0b7858c8ff49a9d20c5111b7598f850578942b49215f9e89e2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de502fdfbb2426df6c47c9a0bdec7eeac9a54fbad41cce3cca69d9bea7014413
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4246b61dbce322ce1f02f772c01501f7e96ea843d47dd1a9ceb7e3ea779777a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e0200f20014c4b64c7c6f8911221f205279812b62a6293874af4a62c78e0a4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8b0b65b3e718ff0dd659a23f556d975e6fea3d7f5be82e90f15ec5f1b246520
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f5b7e2ada864a308eb642fd8f3c84a63d7105e1ade1431970ece727554a0a48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fe17a789c053d9892ebe4b43fdeec165bc6cfaaef836043aef1d62e7ca18333
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18745f09ac01cdbd419fcfbeba9b27caa89c7d88b6f85966b404a8a9ff41252f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a2cd100d7dd8274048eaa6faccf8e8c62dd3127890c360ed81620b696fe1ed7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42ae5b70fdb3e61d7a1edd7acf65d28337fd977b026733fb79dcf9e08af6180b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54944e9ecdfb9defa1910d4020e3ddef589364a72c57628dd2a5af8ca4ba55f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35e2d54083a4c07c24431c549f501462c3f9fba0c85b79359c59578f17e9d10a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6957b27287bf7409d73fee1447a24cbfead33235ba11fefb481f732ac455877f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a36cb7bf58cd96ab63c2d2dead0a35a133921d2fb328539d4a13102b21518286
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 996496a828b56c00484232fdd404d9bff69e9600cea9ad8db40bddd22106d7a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc89b2d6e3aca357902fa3e7b651607885bc1ba8e76adc17f389a5fe4f9db156
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ed5cfca5366f6d7285017e030a30e79d5f25a3c28cf69ac6242f0432e563ad6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d01ac8ebfd6c5fcaf03ffef01b7a42cfe3878c8266a94a7ff2437d1435c1741f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32aae8ceb4cdd7f0e23a0c53b1f854842f14c1bfed47855739dfa16432238cf8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4af79d21843d8d1712942d3ab1f6e14974c5d6f8084693a1cd70b642e6d4bed9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f452032ed564d158b2944f5c6222e9f8ce0fef1e2c62a3706ea8a257d58bb0a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce105758d0b47ee9428f47f18d3ef356730c356c2ae93cd46525e4858f445288
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a74506df6d9d907652822a4da7d459b6e88218083f5c971ccbafbe045d31203
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a0059b7e6666766f92282c939baf50e58f120a8ffdd8958782e4af152d32354
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df3c6c96f7e3e5a286e6fd88b9ec31b7163baffd17feb904b3423af732824d75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 039f92e2e392ba3207837d24ef2a8997f9731ff7a4c38e0a7a478911605d3451
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e39c3edf8eb145066604b7b9ef75dafb1539e6b9d0295e807456e5cc142e7a8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0226e93f969a268ab673f97f40589c7359ba1905226add686aa2642080703401
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93101193e2482026afc3efe04d46d625ad256faccc9dab9a6905d1d09ec0058c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ecfd3ae8b59a3863f3ccce5796390eaa88194f1b4ca887adc3353396a5dae91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7676bf5a3a76f82e7c3435e58f2d5fa84fd7b1893274731ffe91667a68efb0fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33646f640f49dcf90913198c3acdc44fffc4326b72cfc47a9d9733567e47ef46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6ec8c22e6a29a06a765878673726686e58c0cd5248b39ec8104708ce15b2812
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b6c32a4eb761ae6165edb1188e0247e0a23894627124e6014ee1fcff61a974c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 280cba1cce1e83b07ad55a63f45ca5b113d07227622d32b84b36cbd32262f4df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49c73aa3c5baa32b91a5a91febf26006b488fb1645477e1a7232d0c00fd83e22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edfd59efc3a21d8315c2cd72a005e8e0e7234ffdb97e0d9671a952ef03ac95e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 242d339c29bb24c234030c844fc27960f9f1265b4053be099c1d9ccf11ca796e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 610aa6700979bbeae7fe19108df33cf81bd8db51a769d2f1fc6b3312c9b15d04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24be19935a14e87c7a3aae4428f967853fa27368516106e67086040f9d5b0270
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16ddb373b052903eac4824a579f0603e2c75f0e22084c3b66cd36edac4984c67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ba9491c775f219fceed1a1143de4428fb3e40941a9c7f6fe9bc00e21af2e31a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1943accddda674017cc572850d0e67bcb08887e9c67bea70e134c1f4906e269b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3363d35aafcc9a5212583108c917c653ce8d631d994b958262901de6ac73035c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9a5bb41ac4e949c6e118af35df364edbbbda163431ca909784b7706abd1faa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d6924e79aa92f6af4a883ea1a305e886a950b96167e0c5560623a290cc3c613
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92b66272457ed281fba30c78765bb378e9e08f2a30627da70cfd05637f937299
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35452cfe3d91f0eeb452fbcb26a98cd201912eb77e82fcd06de6d59b1a7b886f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7d4c67cf46b40e6de4bbaa2deb0bd531e55e4e50cb68eaa5c078ed7256a6cff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f28f88071e82bc2c9af56aa9a04b7ff15d38e9b42f3261589ed69953505cedc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95997497f04531c8ecb4dfbaa95c74621112171f5d5a7583988b71cc3d9c8b5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2997dbc0bf8476a346b03339ce7cd8bfc7fcf9c5141efaa65e8e506c3e27ccc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 351c11513db1fbee02fef6cb8778e3a5df5b956c6d172dc45aebb3020798ca24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 250fbff320ba178df39c46d372398e47797443c14e33387c40964ff087143ffd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 208c5bb15f2e0ad490177d657f43b58683feb770f70717ee84733bda7dae29e8
              • MD5 SHA1 SHA512

              cglogs.dat

              • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/1624-2-0x0000000000400000-0x0000000000460000-memory.dmp

              memory/1624-145-0x0000000000401000-0x000000000045C000-memory.dmp

              memory/1624-144-0x0000000000400000-0x0000000000460000-memory.dmp

              memory/1624-77-0x00000000104F0000-0x0000000010551000-memory.dmp

              memory/1624-139-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/1624-5-0x00000000023E0000-0x00000000023F0000-memory.dmp

              memory/1624-0-0x0000000002080000-0x0000000002084000-memory.dmp

              memory/1624-146-0x0000000002120000-0x0000000002159000-memory.dmp

              memory/1624-71-0x0000000010480000-0x00000000104E1000-memory.dmp

              memory/1624-7-0x0000000000401000-0x000000000045C000-memory.dmp

              memory/1624-6-0x0000000077A69000-0x0000000077A6A000-memory.dmp

              memory/1624-81-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/1624-78-0x00000000104F0000-0x0000000010551000-memory.dmp

              memory/1624-1-0x0000000002120000-0x0000000002159000-memory.dmp

              memory/1624-128-0x0000000002120000-0x0000000002159000-memory.dmp

              memory/1624-4-0x0000000077A68000-0x0000000077A69000-memory.dmp

              memory/1624-3-0x0000000002250000-0x0000000002260000-memory.dmp

              memory/1624-13-0x0000000010480000-0x00000000104E1000-memory.dmp

              memory/1624-9-0x0000000010410000-0x0000000010471000-memory.dmp

              memory/3340-166-0x0000000000400000-0x0000000000460000-memory.dmp

              memory/3340-167-0x0000000000400000-0x0000000000460000-memory.dmp

              memory/3752-149-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-157-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-148-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-156-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-162-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-147-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3752-143-0x0000000010560000-0x00000000105C1000-memory.dmp

              memory/3864-14-0x0000000000F60000-0x0000000000F61000-memory.dmp

              memory/3864-75-0x0000000010480000-0x00000000104E1000-memory.dmp

              memory/3864-15-0x0000000001220000-0x0000000001221000-memory.dmp

              memory/3864-74-0x0000000004660000-0x0000000004661000-memory.dmp

              memory/3864-22-0x0000000000350000-0x00000000005B4000-memory.dmp