cybergate | f553395154d0efacbe9e2533eadd2de66168caf36b4ca9b3f8e0e083da762352

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Size

304KB
MD5

4ff022ad50b8e228dc43ae52f7c6a4f2
SHA1

be6196a7c0c639e04d571f7ab64219f480a56192
SHA256

f553395154d0efacbe9e2533eadd2de66168caf36b4ca9b3f8e0e083da762352
SHA512

b187f2efd64115c5e25b34d7cf8496de150bce4cec799ce81295655e0e9503ae32634d027ce5e55889c3c5d83ff0d6c7a016a4f1c96f078b8f8c693e846e39b4
SSDEEP

6144:iMe4Azrg9vMzojIYXBpyaSq3PF0o+EZ7PhvF9zHKnvUPd:iZ4nvUokYXLnSq3PF0ozZF9zHKvO

Score

10^/10

cybergate 2011 discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

2011

clnz0101.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Tek9
install_file
Gamer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
nosorog
regkey_hkcu
Gamer
regkey_hklm
Tek9

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Leader = "C:\\Windows\\system32\\Tek9\\Gamer.exe"	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Leader = "C:\\Windows\\system32\\Tek9\\Gamer.exe"	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{LGYWT072-688K-VTWY-22P7-11S00O1D3CH6}\StubPath = "C:\\Windows\\system32\\Tek9\\Gamer.exe Restart"	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{LGYWT072-688K-VTWY-22P7-11S00O1D3CH6}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{LGYWT072-688K-VTWY-22P7-11S00O1D3CH6}\StubPath = "C:\\Windows\\system32\\Tek9\\Gamer.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{LGYWT072-688K-VTWY-22P7-11S00O1D3CH6}	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Executes dropped EXE 2 IoCs

pid	Process
3700	Gamer.exe
1376	Gamer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Tek9 = "C:\\Windows\\system32\\Tek9\\Gamer.exe"	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gamer = "C:\\Windows\\system32\\Tek9\\Gamer.exe"	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tek9\Gamer.exe	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
File opened for modification	C:\Windows\SysWOW64\Tek9\	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
File opened for modification	C:\Windows\SysWOW64\Tek9\Gamer.exe	Gamer.exe
File created	C:\Windows\SysWOW64\Tek9\Gamer.exe	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
File opened for modification	C:\Windows\SysWOW64\Tek9\Gamer.exe	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3700 set thread context of 1376	3700	Gamer.exe	90

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1940-2-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1940-4-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1940-6-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1940-5-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1940-9-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/1940-13-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1940-28-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4232-76-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/5076-148-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1940-147-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1376-567-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4232-568-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/5076-585-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3688	1376	WerFault.exe	90
8	3688	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gamer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gamer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
Token: SeDebugPrivilege	5076	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
3700	Gamer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 3668 wrote to memory of 1940	3668	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	83
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56
PID 1940 wrote to memory of 3488	1940	JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:340

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2856
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3812
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3904
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3968
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4044
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4156
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2124
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2952
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2364
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3276
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2992
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3392
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:1948
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1892
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1100
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1200
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4536
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3684
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1664

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3380

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:4232
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:5076
    - - C:\Windows\SysWOW64\Tek9\Gamer.exe
        
        "C:\Windows\system32\Tek9\Gamer.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3700
      - C:\Windows\SysWOW64\Tek9\Gamer.exe
        
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 568
        7⤵
        Program crash
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 628
        8⤵
        Program crash
        
        PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2756

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 1376
  2⤵
  PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3688 -ip 3688
  2⤵
  PID:3224

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 5438a6b330fa8c0cdb710c2ee0638f06 8e8e8B7UAEi8IZMbLQUunA.0.1.0.0.0
1⤵
PID:1500
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4040

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
05da73dcab29e47c0667736e4facaccf

SHA1
fbc2157b662efa2669a20d60a5dd90532413c974

SHA256
fdd67b9ae63062b708ccd1a60e17ee7d24669fe73a2024fcdbcf00a67c0dedb2

SHA512
59573a70bd679c2697e1d86473efe9c3e49493765f24fa807550406433239e448b5a4e1945e49ac9c5276399641303f9cfe8a256cbd9d5db996e959c3d6ff9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
3f03f43414aeb52e01fa37cb3b4ac407

SHA1
a1d92ef26c07b2a640953e0aca5b16c41e39d513

SHA256
b9273a601fadd23fde3e01ce7f86f3e5e1709ff07d540ca757e925ce97f26e29

SHA512
1323bb738839d648b3ed01e3bb7b4d40211b76bc5396db3ec4ee43d813aa0b397699983343b2703ebbf09ec1f506cf3170c75baebcc26e64bf76b70d84a2d78d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
85058668794f245b850f4ff78f1117c3

SHA1
f8cb9e8cf6d3a3dcf246ef9aea53bb54d3bd4a1e

SHA256
7cb12dced66e98a7ad8088d363498009611621b76ba3aad8ac7846220fa22dd7

SHA512
3f327988c3704c71accc48dd1f16c5ea29441f7c21546f1991e7d13d550693b473a8f2a7e5e90a71b02b68255d8d0aceb06f3e771ff0d0eb2355578e45d5e995

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
30a8bacb596d6c31ccbd80d979842b6b

SHA1
826e1e2702f414548431be31f4c7e10afff045e3

SHA256
9628f8dd4bf3eedb7616cae7154e2ef84ce294553894e3a283a301d2efde60af

SHA512
33f7d2da5676cd23123836698be1e5c2fb5282832f409de48bbab4112f66a63648fce9ef9d6499d387ad7d04774a27a2c7304b9dffa8f991d8d36e4a724cbf81

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
37e0e45c54a322a6dee6fda5ae850ce3

SHA1
64a046171f01498c17bb9fa9b0b34d409b9a4918

SHA256
c085ec078d9238a010aca039b0fd9e8e85b2410bc76d147f8782594f0f658c6d

SHA512
7effdd3a84b144e92c1f8729699bad81781036ef00cc906ea0a36297e300eb7dfc7bf36da0d019e38e84f83db4ca00ef5ace60b770fdf334a6ae2067392e90b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
46a43b420249f5cb468ba16a6c5ea4f5

SHA1
53bb0204692cbc7fb6f45b708ed98ff741dbcbdf

SHA256
e1583322e8cee436703be640348e09c23c79fd84b37e4646d3a2c847ff8a38dd

SHA512
45424292851cf03c5a36350f87a93e3ea0b5a01e6f98a93d1347914602257c41a9850743ce35b8ceef18c2e65e1100b4e34ce7154494047350de5e3e4c724cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
fb2400b54875d88d10fe9a7d5aeb5e52

SHA1
3f39aa9401f69d92308b80d1a2dcfb0be9a3680d

SHA256
f2b3479dda55f18631cc2874c148430b3888f9346e512cf9237bb279350fac1b

SHA512
5388a7f1232d73dd787728dd6f44b0a22d64cd44a19613da036f910a8505726264b277dc0819ac74d37caf516d9dee8b5fc872d74c3cfdcd2270504bdfc8b9c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f091c3aee0edbc689b637277126be128

SHA1
947b34a45c77aee8628d5c972ddbd5c1bc6c66bc

SHA256
f7f4ea7f96e9df6634ccf34f018b58ae9a4002113cc1d1be0de7c0e4a4bd65bc

SHA512
4daf0313b8008bf5f73d4f0846cf844797954c4c8140e80d95fa53f87d63b781e7be1440dcfba88557c883b7df3a64a33ae4629090a6b4d7897586c117bd38a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
736bd1988ef24171f1a2261da2c35309

SHA1
55b8560ebcbdef2a5507743b70a9b6a746496491

SHA256
d9f18e4019f66802123a4b57618d9b8fb4742d2ed7bcc3ea9d4a3307cfcd5a98

SHA512
3f37c8f5ca7660565af62ce430827bcc3fe1a1dd22a047edff34a76f7078974d5f661d2aa92080e16300242d37923d4a20e632036fb4335e256401f21eba12f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
907f767745904144e96bb9643fd1e1d9

SHA1
0842383c2fd56b9cf748e492369782e078f3afaa

SHA256
c8f979da834947c3258fda1c0732509ac95d6493d84b1359d7526fef8a4dc8c5

SHA512
5a4b3e3ae50ca52fa6c8efdf87d5265e115b0db589eddd5e4d5cc580c28027ae99eaa7247e9f632af623e01331ad23b3a25b70b2358d1bc83bd7b97b71ac74d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
420b88fc982d0f9a3a39cb7000f85a92

SHA1
54557e09164ceebe9410e7a07bc9274f184f01b3

SHA256
868590b83599b42f7d5831cde566afa4c3e757c68786ec6705e821ed97fe7135

SHA512
1fd991aa437e778ea5f3fd1ed810412fadd7d37dfdd4afd798b9fe8760bc2d64e84ddeb0fecff5ca1119bed191222c16d55693b6aca8f92c925aa680db6543ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
83468d4a8cabf62eda4fbe650257b882

SHA1
d31228e803885b2f7dc38718ffa50c3bf9e5b9e8

SHA256
40ab855cbd7127dbd857a873d56e8e886489984757aa82657cb124580e2b9f6b

SHA512
3825c3ecac055343fae75dc69793221a27a6f4151d8412e8ff0db12093fc4efd4b0cda76990fa0d3a2e840f04ebac5419ab7989d8bece7466076a84758c55e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b332891e504ad4159b905798b48e496a

SHA1
d4610aa3ff39ac0b0e2c94a2d6f828a8d2679a17

SHA256
147bfc15a266c99b92c5a0f10b6acdd0a990ce40b4b9f50f193c5f0159d743bf

SHA512
81338379e3e8053df73a28aa8c08474919f3bb1c5560a12abc413a77d73b74609556f9af6efc3f32d77137ab0f40af4a83e1c69aedeece42b85c16749c56d6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
3d149a2196437431a4c4ddc30cbeeb9c

SHA1
927e7e4df9748c5a63f14d9531e298768c34c717

SHA256
bcd9a92b58b64281eebc6780702c675ebf74a0323d569d35787b0cc3e9619bbd

SHA512
92e058a2560b4ace953cdddeb5608edaa33c31e527217c915b7bcab4266f2041b0d78e2ef123b27f363d453dbe4487530b64810b1029819cec52301c2050f8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f2e9bc6caa589b3f6d29d6b9ff45b8b5

SHA1
4857bc7445d4bd05ffbcfb0d90077b6f8edad821

SHA256
d1c104f0db369ec137d8082417516bfd3218be649eb9fde3498aaf8ed0aed5e0

SHA512
d707d76eba8edc0624fed684b34f115ccfb3dadde242ebf11348f4fddc68cd4486d140149a9e236447690166d173f0298b12f26433dba80cf95fde59843a526c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
70bedb282616e51db466635e0987b236

SHA1
ff93291b994db211692293a484077b7d691b311c

SHA256
c64ce0aeebb26fb573ea1fad113a27c08a3a498f1ea53151fc9923d54d6b45fa

SHA512
c26542c595265bde699e6980cf04ebd4bf5b7f2526a4f5c35ca77e71b30caf42e4505f4bbb8d84031160a862cb12a8a01f47843e7860c8bb85cbefe9522c808b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2f1fc2955f3c2f4bf5f7dadd4a8c6e0b

SHA1
197ca5203d491b6680c4aa71e91033c6aa18df93

SHA256
d404eb6237a5067909fe2b2e7525ffefe34b958d053f96a817d5c7ec079af2b9

SHA512
61510278ebacdf4809123da5fe44bc47022457e545210158c0b271174d9280099702036a108152c818bbc00e62c7dd1187fca1e00696b6793193d4a5dcd049e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a92ab438899c155a5d8567d43319170a

SHA1
4f8416f31d64eb3cebbe1b0bff90026e0c69b91a

SHA256
3df2810e683f4800f9088f98a66435ada8b9f0023a91f818202bbff3237bde62

SHA512
0512a49193e3e706b376df5701982bfcf771dd311d2325461b13aa757455119bd77ea05091f628c29a80becd4b95db7f280c6c74897d0c4764fe708e380424dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
e979c3e5ed44274a3640ca149f0c85ce

SHA1
881c74335911107f0b58554ae267cb67c47fee47

SHA256
9ffcd10c83b360f845853facd322e950f5e7c9c53b27a4c798555c7195c17482

SHA512
a41518b3412266c4dc1d155e2307d48c7a10415b23224dbbc75dec31aac2cbf6a194be4517991a6fd3180591c1210355ed968dff3fb4dd1544c8d3c00b22c4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
21291f1d135818d41aa2e3698810c20a

SHA1
c37e9a860cff79478825589d818ecf940e0d4783

SHA256
562797b762f04aee7f0e64fa4421d44dd3498cf6f751dc1559a7bc48cabd920f

SHA512
15e64b5000474387762935087078544dfeae51bc7c59b6e8596e4809d6131fc0e4f841633e2e8406f0cafb49adb0797610369ca625a4f57ccfcaecbb9e7698c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
6a05b483c9cb87498d36a2e836aaa213

SHA1
a3470c6a65ed232363dc9d8c794f7b527e848c49

SHA256
29b0ab10a0511b91282f00962633cc221916bdc9caf4b5412cd83af20eba21aa

SHA512
7fb26df6bf3e1198fb185817123855db4f6799e9ec35d3e48e2456af6bc99de88f495445771b95fd401d06fd18075ee68923796388a7f783a2d9280892aca873

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
30dffd8b678463ed36699a2454961bb7

SHA1
1e4c9cd9dbb40b4e356aa1e306531cd04d112b1a

SHA256
b4fcc9101195d9e34c87b9a2fd8c80ff04557f50daa5d8852658f678c26c08d4

SHA512
1b537f32fd802b0d344ae236e7edd95609bae0bb9384d60f3615d2252cc87dc29748196ea3739b7c6aff7c2c817fc9d8db065e939977d25923ccf8d37f7fa6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
34747694e551caf3e1b22e264bc22768

SHA1
dc8271e8b92cae803e29c6e1e1c7e8a5806f4953

SHA256
c7df5afd3e60443b90460e5b0ab5a7a6210afd8b1e2f791ec1f5ac51c10b15f9

SHA512
1365aeba029b710c44cf24da784b85dc060e5113e8382d1b442ed1d864d32ed6396835ea4253245bea597b299a4f150d48697d07cfb47d05eaf49ce946282dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
22ba5459106f738933b4c8f982db251e

SHA1
31b0801609f7d028581d987b0d729cbd190872f3

SHA256
3dcadb8d5877c7f3229e88ab6cce64233ba1a4cd2e801affa39df15546391b18

SHA512
50ad953281b293f40f177bf8bcf5feec9f3b64847193aa582238750a1b216049dcee269666478ebf34a861d0a425034ea75d898201dd6f11526af7cf6dee9cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ca2bdfd4b8532d7dd0bba4f55489fa46

SHA1
a1940e9ad9b13bed1bbf26805343a8e30d3a5196

SHA256
e859d6728e205035616c12d0dbdf96c8d7f1689f940b7a2d8047e20b11fcc3dd

SHA512
7438f90d8ccdb1747ba5f61bd0d013d66925f00c68946f20d6007f94e459d6c5cb4edd288014f0354ca5352c014851b9766a4cd42b223baf99cd4d5fc7298efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
35a7f5cc290b14e327eceea333d30f7b

SHA1
5510028ec766de4c6f9cc90742dd8eca0cf6e7a2

SHA256
8cb9e20e65078770d493e8097bcc5c11be10c5dba1b8a61631b61f7bf87789a9

SHA512
b3a63a39caeed89dea66f829d07f6b8e72d17b9a76d0abaca20d1c4ae33a299420c779439e23f7e8a9a1df370513b77405c8d40f92d9304321ebf9829b3b579a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2492de4fc6b5b94fa4ea112121406f66

SHA1
751b745a564d2c965d66abf74f5b6fd3384766cf

SHA256
ba0248ad317fb74066b526912ec99fd098e128284936e00143f8e1d4932fea73

SHA512
3ee062dd2d661a280fb8b192ca6a00a0bdf454e37bd3d38188698f1b287a6dcd028b9d6fcf91eb1ff592b1ddd8aee7210ef5c0e5d1730592cd3172f331dd52a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
20943421556249554c0e7a81249ec810

SHA1
5c41f06a792dfc6f1dd13ace4ad486cc8b6cac39

SHA256
fed020ac5a38040e5fc367ff0fa5b4c0c84503d3b80ac92b09871463bf513949

SHA512
d1b093c1be82ee8c452f31205ad808d9d53b66a1523e1dd54b8d329a3b405bbbf9ffd43ff90b70957242e483aa54cb00f094ed0cc9fb722610029eb621848d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
252073a864a601efb31c5fcf753b2a68

SHA1
e6d7d21cf36858c9e77c80d2f876be85d4871f79

SHA256
1a04fa471a0541469eee0ac19b24af83b838f216c44fae9d4c47e7034ec3afde

SHA512
761d99d2d2f1315e984552409f617ace7c0fe0c8a95454ea61d601f188d80b2268021930abab1b2ef9f9166a576f228e35658096615067c3eaa74d6d12f7e835

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
793aa15c969d2b851b81e92586c22bd7

SHA1
71a5dfeec619b0245c6f8014829842bafcefaaa0

SHA256
0e2d3836d2e95e6e663088f67933672e8b75475040b0e0e3c21f14a026bdb3c6

SHA512
8afeca8505e91e11f678b57585d818bbee02ad0f9e521c226386a2169f355714b41a8dc90572d99c0f93f2cc89414cdc3a0dc2f67e406718983b3e032f696592

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2f9a73592daf84122fdf8201baaf9950

SHA1
16237c26aecbf56b1f52dc916c5a594680b675ee

SHA256
22827f7d1ca7bea08823cea3e8900849772be444d8a9beca929c3ad23d0b055f

SHA512
5ffd8b15f309ada1dd063ee73dbfb4b9482918ad732e5f0a8001cdb02af360e3407645af5e79c4c99fd0d2b8f1abc016f52321b0392d486a42baa71ed4e37c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
cee11fb28667a0aec92fe569622bab90

SHA1
87ae74e3ff7a278a485416f3e8dc7217cba42c75

SHA256
b4a441bd6cc564ff22788f16cce1cdeb0b57692836f8a98f5c851de4d045c086

SHA512
66e15fc9c3dacd056560c7632ffc704fb99ec5589edf6f23ae2778b70ad55f7612db5696bec514d7aa7556f98e1a9290f40a7a577e7d1d1bb1a1f519403f3241

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
92894d6646682e9ecd2dd8f11b0231dd

SHA1
9eae46cece5a86e7782b74c6b88e251f29ac00b1

SHA256
b99e41679cfbb6552202d41c67cbcb249b6c51462b2ce90db510687418fc34ea

SHA512
89ef888194016902d73f9eedbceea6eef3328ef1cd550446678509931dad1d603b7fb7959393c7f1dd9d55feb6ee740d0af36cee6f8ed1f3db3e979905e66f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a781fd15d5a2352bf514593154418f86

SHA1
08cc0e197106e2c93cd715cf180c875b9e2afb68

SHA256
cb5953e581c8e119d3083684e680e65f7cadc2e94b225ab08aa572ee193a5c50

SHA512
4b98329c0531c4199884d32ad77d7066bc2735355debd25473db55cae03c0de525fdc8de4e99d8e06df59da5acc5e1d0d025a4514b0dccb752df1e2b491f47f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ca4e2fa40b465f1932b93b1d59e97b92

SHA1
d9ab6095d23f9ac86f8d02bbd318bb8568d21918

SHA256
f27f9ddacec30f9b4de1f8a8cd5c88291879c9e8737a075d345a6b8c93d1c00b

SHA512
a6371a3b370bc76e840dab77f7f703d9353d58c6a3d277584c393df090cb4c868c5f1704db600ede9b812c818831a952cab144dde9ddd55dcdf159a8764a96d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
27e99eb39a85d0d7a32668691e3c8f7b

SHA1
ba1d6fe6bc02af6085e213285586719aa37e576a

SHA256
cd068aa39d4d684f4b5f6048e5d10953225f6b2dfb9986c8b0c4b6345d3aa666

SHA512
e730d7f6c20aabfb4c3a29135dffdb71cd8cac7afee00444934333a10c5c8ef33244808a986ca90c956c8a29323543887370af48f04a2c240a1f362408b3149b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b392c0f9eff8e162e9a3202eb3779b4c

SHA1
e8ce3ea00457310f51047fecda810321eb616c9b

SHA256
ecdac1275f9018df4950638f1600ccc0343a1e65e9326a9ea32ff8ab8e254e21

SHA512
23d18e38f413a3db9cf582191786f44d0c946fdbed989a557c4b59fbf10d11278cfda5fe366bfe001c254f55deae19887a38ae2ea83c09fb89cd73900ae4f9fd

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
e21bd9604efe8ee9b59dc7605b927a2a

SHA1
3240ecc5ee459214344a1baac5c2a74046491104

SHA256
51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

SHA512
42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

Download Submit
C:\Windows\SysWOW64\Tek9\Gamer.exe

Filesize
304KB

MD5
4ff022ad50b8e228dc43ae52f7c6a4f2

SHA1
be6196a7c0c639e04d571f7ab64219f480a56192

SHA256
f553395154d0efacbe9e2533eadd2de66168caf36b4ca9b3f8e0e083da762352

SHA512
b187f2efd64115c5e25b34d7cf8496de150bce4cec799ce81295655e0e9503ae32634d027ce5e55889c3c5d83ff0d6c7a016a4f1c96f078b8f8c693e846e39b4

Download Submit
memory/1376-567-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-4-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-2-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-28-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-13-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1940-147-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-9-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1940-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1940-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4232-15-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4232-14-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/4232-76-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4232-568-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/5076-585-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/5076-148-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download