Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 05:42

General

  • Target
    8614679a9220a5990d18291cb46dccff.exe
  • Size 292KB
  • Sample240201-geh7baeecl
  • SHA256 77e34a1b0e09e4bb8327bd68ee86dee48911e5dc93ec62e6608eef79355fd997
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • aw.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    System32\

  • install_file

    cftmon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Aygýt yüklemesi sýrasýnda bir sorun oluþtu. Lütfen daha sonra tekrar deneyin

  • message_box_title

    Uyarý

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\8614679a9220a5990d18291cb46dccff.exe
        "C:\Users\Admin\AppData\Local\Temp\8614679a9220a5990d18291cb46dccff.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1900
        • C:\Users\Admin\AppData\Local\Temp\8614679a9220a5990d18291cb46dccff.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:4064
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
            • C:\Windows\SysWOW64\System32\cftmon.exe
              "C:\Windows\system32\System32\cftmon.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3792
              • C:\Windows\SysWOW64\System32\cftmon.exe
                6⤵
                • Executes dropped EXE
                PID:4616
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 564
                  7⤵
                  • Program crash
                  PID:4844
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 496
                6⤵
                • Program crash
                PID:3712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 480
          3⤵
          • Program crash
          PID:3196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1900 -ip 1900
      1⤵
        PID:4348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3792 -ip 3792
        1⤵
          PID:1004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4616 -ip 4616
          1⤵
            PID:4820

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 e68e781deed767d6bc99425fa0a80d8f60d28ccf704aff0661262eafa27e51b8
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 fc2732ea6bd4317f3c0972c9fe81e7937b48ee57c1aae3eecf81c89391774b0a
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 427ee5b6f00399548d74b1c147b9d60e7449cca2b493a859dcb097f15f79534d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9949703a8e3cac4a8ef2607074178687f49557da5da105cbbde04522cea8cb49
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4b71771d8c84b8764759ecf94ebe9e0d8344762a0fb631a54fe8bacd36813f06
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5f054c07c9e3e7f8dff12b5d72e802e89d2d8abc8faff1b3123422e9349f08ea
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1c79aedb3af5254c83182b5696bf138133ce0ce603d1110dffad12897243171c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ec3c1815ab840ed38c860de3c2b8c11f8f5c1ffdb909150403c6f12ff2ea6b8a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fb370e05ff5df690d80984256fb832f886a9e9668f743151e1ed018fcad79eb5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6920eea44830abd204eb5cf901c92a04669bed6e4faad1d7206d8ff2332f7596
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 775e48a050331001cf715ea4a9f116953f8e8123562718601ba8bac68fedcde0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c0a9615c93026917ae0c5871836ed536aecd13700fcdedc119a9d690092dde74
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9a5a91047c11779e7ce76321c2652dc9603f5711ff1eab005d38ec36f7a97dbf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a56c84d395f9abf8b9324c7fcb2154ba278fd7aa96f1af998c16fdb9ae26d408
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ce20ea7a2aae259cc28584fa2e7935020d8ff644a438ab8437f81ccf8af7962f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b558b68870155d26e6ffd7e453e80f394b192995bd1e5b0222e6f02b5852decb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e59ff5cbe6c841309e4682d158668444bf601d2b367b330598127864381d0de9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5f83828c59c11f26f36fc5d5a081664f6c784a729b8a79ca29b5ff14f41e6b15
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 36db81970873dc8413e5ad1b856a6fd726ed677d28d44fe68f422e50aa64f60c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4d2527afbcff142d9216dcc8b076912ab6336f4c4f3811912ad80fe47d2da423
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 20e77adc73d1d62c0aea74f2c3d36625301ffa87277d02d48287566070dbb3bc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cc2c7a5bd00254790c3b5edd163bfccc2bb7d0889f070f0161b8ea04eb5010ac
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c9449613c355ee79a2ad28a092e9a8ef1cb0471453491cec2f36efb745ee1348
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5bd4b2cd96447797231871e0b35637f227f3043bd08eb398f1ecc230852b0899
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 aef5bc6f3cdfb99a1906a9181db80c09465cf08e45868a2aa7736258021f8d26
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 003c45bb426133c34fc5874c488745b08b77202564785119cd6977aeb5c03126
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0a88feb0e77e82c09bd57bf7994beb6e93b3559007bf12c720ddd7a58c897125
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 89a51c93fff290c377a93dc0b0638aa6d952185563a340093b66fc83e967ad71
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ec0c2b8a60a8f1143ad37a382c56f87e90523b13bb25d750c799f01ce64c0318
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 289fd01eee60a5fa22233665004d2f9ac767dae2833d50838d20dd3b8116ca4c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8cd7cb2fc78cac5318da804eb9f341ad360a05d2f628fb29ce739da877f72290
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2d6c33fac6e443b0079cec8a7eb3b0b478c54a31b53f1ec347840c28b6576e21
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b9ff767ad37dde54465d107a7879edc0e6b66eb577b003d3716f327cfa9d411b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bfcac3ce28813fa9a72a183046f22332c400dc4dd72c5147f41a9cb5a8b44fd2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a4890c37555e80f9d8478f8a608ce699a173be4c70fafec61add15ca7097d54f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5a46a86df18d3cbb11442b38ff94e75dfc08dd7b895dc49b982d3eaffd242d5f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 21a1275351d4936f2d8e6cdb2b275cd4c5e714a903b09afeb2fc546d81cb5bf5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5d7749899f6269429c8eda1b0f44b9d9f24a7dc7a46416d40fc4263564a734eb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 643c6edb88468c16dadd648409e89f7072c62da6c29ebd23a8a65f6b1597bc38
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 792665f16c73ce337e75df07a44ea221fb3e2ccc6737b0c233da6bab550a9a03
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e71e109818de2e0da91f56e125585b48fc46421d9820fcb676ff0c3d50ffa24c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0878bbc4f5219c748d8c712f1650a1e3a4245e04b9ba8136fb43012b919b79fd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 efb9a19dbfa21052c8a224844469c106624a4a945fe7babb643fcf4b732ac2f2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f754e89b625edef2995f875b501f4d57f8d2312c1be576ae1f6b325ae85f2f38
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1dc77c098bba50e0a2056e5bac912a9ec6f1712ea090e88dcb69bb578cecc889
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f403fb2e52e9ae60ce505eaa1bed6348f6f106a2958eb4da6a34b4b5863c2e3d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5b54d61aff4ff116ba00859500acc94e7273a3b2357383b2abd14e84c2d9320f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4734babb099e6ced54486256f61f0a4df08477ee52908b0ce5a98f2b00cbb450
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6b5f20c0aacea5a2fc7e827ac83b0338612d0829f6b9e4dfac31fc83d3dc8a5f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 191b6cea7d7ba187504fad7123a26e2d94165a89b7565ee88d211bc5ef4b93a4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 281fc5509504172168f08dd4746fef7a3b7166f95224c1ad7246827a582bd1e2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4835034b63f59275a6fa8bda2ccd59e6584b47ef008f416a2970930760e88b60
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9ac48cc2f9af5899052ecda8e134d61b81056d27341ae588292ed8ef13f0fbb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4a5b7692005147a3b5f5689a88ef3a0880f58af0e85dfc545b580584215472c0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3096cd0b40797dd8235ba654d227bc4ede22e008316a3ca68389a24b7517d075
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3dd2206f4f66c5e039f17f15f3f4c5626ccc461fdc43863f5e149b13d836334a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b922b9f77488d0559606bd78f6e48d3b613d1a2f3a76708282a83c254c55db8b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cf8e1d51387cfa5cb8101a62fb70746d6b2d3233867af9503e53050842a5974c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2884df1c1e9ced83da0279ebecdf7f0c2a0eb38c153f7ed9c3fc1745a87ab580
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 20beb78487bfbb2b3e5b4eb11cddaf4e5d25d67d30982ade7d645c01e7b8d5bf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ca89afa1c617c49e46f724f1b1acda0470fcf873dd1655e1439e73320ee3680e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 20e91b8941ec8944d73f90f862a5301c18859c2eebb9fb2ea0d32faa99b3c57f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9b6d980d3115dd63d888ff6250efcef35740a4ac7f3e9742c77aea87a911f6ee
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b5091232966a8f341ce22e2c420c635a3d5f9b1547e47abae883752645a1a38b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 50cb012b7c9352d6f625a255c60926716e0ef0d308e2eed906ae2a1efca8c7ff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f00729c658da165b64b88e9926fefe54beda5db999e01d1e3b0e0a7699a8a569
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8cde3ab48945fa8d6a32e5c907acf525c86678302662e3d72ad0ed830912c29f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 039399d55db5020a7ea97d451b1c4f939bf64ceaf256da65ed422a67230ba640
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6248691056132b270a47e571dd7de93cc30d276f3048484ee5f333013e4e2ae1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b4753718a548dbe066528892ccc99bcdef47fc6c9dde9e2b7389a73d8e52bad6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b8588f0d8fe13d5256f86b5c8495cdac324eb3771fe9f36caacb0d0349db151f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 10660ef5bc4647c2a7d6da12b63a34bdbc625489d5cd66eba46430cd5fb39c67
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a8aea5c79e3cd59a46d30ad544927264e0a500a6a68aa3ae1f1a9e6b2f28f705
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d3381d06403a891602c8d5a3fd6457a8e34cdc21e10edc12a999675ecb01f770
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 805a60d16f346605dff1e8fa7f78cddc7c493db60ab43d225be34245e529b237
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eec177133b094ed4af69d808cc494cd9618de61e703a81dd51e4d07d238c9b08
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8c1eb9aadad4a3ebaaafd9228242569810d6414f94a42ca914a4cb2d8be23685
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e6cb3a062b7e9107dcfb6f29adb3a6044b2afc55b40603305f00f20fde6cacbd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 494142a733ac53436b9319b299c96f679a74f47b2b29535d16293953ac39e7f9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 55595ac85343cec463a242dc8c1927edf0bddf0cf31e3a1604584c5d611035b0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 91a88b8a2b27f8ec97a5b99608e6e81da38bd4b26fcfb8399789d5e2506f3d5a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4b98ca5f93d395e23d343863ea1a07419296f903e386fdfb851e523aee4301f5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f44e7a9731b8a72083c782b58c2e29345caab7276145149e3a79dc5e9eee624b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 918adb906a726e2cadaaf2fdee7689484f24c0ae1700aa74ca1523437b35c256
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 21a9b3a9920cf23ad262b1b1dc9fdd55d7b945a01f18b7813057df3a17bb3412
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 acdaf4175171b436a3be7335a39798fa979e55ceeb62995b95d5b662c35e7bef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eaf0529a43e2ff89114706fb09509e4587e339cd343b1895a9b632cd8bac25d3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cce8fb702d9659d055681416a85a93f6125667aea6014b0f98248174f79177de
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 856caca2969dd4192ea0a2fc2fa654150d86c1d59a89832240c2e07efe526fc6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c30941fa72dff5dfb9350f5866edf371e25d1442019db7b01aabef46bf0df8b3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bc1a454b234deb0fd2781c0a0ab4236d31915bf50f0a513381bab43f8a81c426
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1776144999073fe98387de17a391884e36ae2255495449be456930afcc4a9510
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ab0f26a101376b0a5a7084a6c526674fff5445c21da2754b13fc4125a4694e66
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6533f32cafd77fa86477b0439045dcf2c9e03adf819e5f2997c7b5c74e30e5c5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d4954f57dcd046cd22e012c057059dce0e4d09b54e650cc12ba82f5011baa48b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e666f583f444dc72da9c76a4c5ccf1501dfdd853954cae0f3f0a3e843caaa1f7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c4c8139173a6b5a27644d704d567d8840eb349cfb77df08d19d8ba5853eb8981
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 52d8ccce5733711d82fececeacdab26a8e5f3aa53b6c48df6e9862c3bbeccb0b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 951437fafc5688e03481ff4f8b4048ece0c0f32a6f39f32cdce0f7e5edddc970
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 93276bdc0648b1d276aeb8ef3b9834db1a7cc921c973b962793830a7e5241f8b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b542fc556c63981184e448b0a88407369698a3beeaff9420d10358decb0aa80b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e40332ddd4585eaf4ea968199db263bdc834f4d48a01ecda5b67f8cb745392ca
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9ab5e3ce49cc70ec25af12fa6c0434263cde8de7f180dab8a0ee8a111d184e3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 967366e2061444efb6fe13f5eaf9b193fbe173563275c1acdfb78a6fbb22d346
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9a1516cb7f86775e3ba5df82cecd2a6090b642f506ee1b9bbaa4334e6647b577
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c86be0a45c1e6dd673355f48ed5d2e53f1a41e3fdccd8c8194d308e26280d53
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 421ca726d5f8c74384fafb21b03d2036b7b810fe0e8b6f0f1fefa0520b99ddf6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1c33278877e248830a18f429fa14a01117fde120ab45ab6adee27d351233947e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bbfad1fa5297b2a811b0c954cdffa4d2f235205e9518c8b4df3090f843b90ff2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 48927e3a95d162448ad2d309ea4dec7da67479f4c8de8b158c0816bc5ec4c35f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1566d5a7d383870d2f47e7119f4e8831bd2a95bc9e75c2378aefe82a525b6e20
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4c333c77552ae14b08849c4390ce49f4da24c1a0462a19cc93fcb2917c9ab34b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9af4c3d429b9d8b6beb8b3a60bc50229fa39d8c1dc8805c79ca94fb59af82b6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 28e6bace4819007f6eb1f38355bfc2c1650c63a2413e952923b22ff78e2f799b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 27898426797448a077efa71e0eb2cfe1e75e801aeddcf9f79e1c9216ff2373de
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a66cbdd59f5f5835b3c442fe7210995f88e05a1e614d0f20ccd803df4ffe8185
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2c6b4cabec9d9c3f48072f68de1c6abbdaa2e675bde5409899e16cf477e6a993
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8971c613374590892ddbd47a35328deae028f65dee808a46d9b9522205432914
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3f05698c0f9c29eb5c77ae323ab05dc5238b2a38f6eb95b601c74d111aa1f571
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 619baae48404767eaf94239d65c701011d396d306798830625fe5af1e27ff3ed
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c97fb60498112856ed7236aac42e53305212997ba509e53333b5ad58109dd722
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 992a30c2ec4065410087cd41039b45e868aba5202cc7dec4090e3dd066fc5ae2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ffdda2304baff4f90d2f681491cec65b223526b57ab3c894c12fb4260b51bdbe
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5e34580d64f4f7eb65930a791797be6f41ee9e1e2cf32af3b77bd729eccf8560
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e77fa4bdea3cbc6e37dd81aa301ba1f026cf6730ea4c654d087d0607b00b21d2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b3ab9c3e904ce5a236a660472695bcb41cef91d0592e750fc2e01bebd2c44cc7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0872d84971600b0c001ea520cbd61ff04f8d1bd76a4e53fbedd705a0664daca9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dfa53d432aaf34ef7645c9f3cf6364e997601747e4b2bd2657a6cee1a63a1ec7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1ab76690bdae8f38d4b06120c0aea2c33a0a7d977cc620f64f5807edacd5646f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f10d35d0e09e47cb829155c6c4229aaa4058ffa4df09846b7d9dce66de225e1c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 67b0e36fd249c7fccd03eb5c44a60454ef14d29141df6e1c1148618a4178fe3c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 54d814d0b026147c2dcfa8b70fb5892d9efcb54020bc190d7fcc4af14317a025
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a1d3ab39b2133df5d771974d1da8bc8e26ed43b35ef2801ae576337f6de7a3ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c358a5d08166bc76a3562d1271cad925b44cce5857a6df1dfd1f342a8d2625f2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 444c77b71cdaa8eebb6538557f39edf6bb0aea43a742b8936a5eb8266da643a9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8e31fbcd8240155ef429917f10146c74db6ad925bee0f10f3f99c3ba99918ee4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 24607e89dc180130111b6e6acd8d9c02a52decb381a933248bf161ff4ced39d3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0a34b104710f67e52272fb9c509e7c01c9e44bdc5ad49c2f32a9e1fe80608806
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cd373af422a9dc301dba7c07b797c15be4cacc20f89bd516c2aa01340c9ae80a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b4ed763e1fc33e04d7d0d1a2be82afe5b681cabcaa4166c1ff2b64fb5aa6b0b6
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                cftmon.exe

                • Path C:\Windows\SysWOW64\System32\cftmon.exe
                • Size 292KB
                • SHA256 77e34a1b0e09e4bb8327bd68ee86dee48911e5dc93ec62e6608eef79355fd997
                • MD5 SHA1 SHA512 SSDEEP

                memory/1900-8-0x0000000000400000-0x0000000000406000-memory.dmp

                memory/1900-0-0x0000000000400000-0x0000000000406000-memory.dmp

                memory/2604-144-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/2604-856-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/3792-176-0x0000000000400000-0x0000000000406000-memory.dmp

                memory/4064-16-0x0000000000640000-0x0000000000641000-memory.dmp

                memory/4064-17-0x0000000000B40000-0x0000000000B41000-memory.dmp

                memory/4064-77-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4064-183-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4424-6-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/4424-3-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/4424-7-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/4424-12-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/4424-72-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4424-145-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/4424-5-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/4616-175-0x0000000000400000-0x0000000000455000-memory.dmp