Analysis

  • max time kernel
    151s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 00:57

General

  • Target
    ba1dde2f0d0b6bca87f6fe173c158f49.exe
  • Size 834KB
  • Sample240308-bbfdcsbg9v
  • SHA256 cbc5f637a3fa9467f1c51a986ffc092a0266d7062a80c6f7bbb92ec931e6cb0f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • MURAT

C2
  • meltemyaren.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    cftmonexe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    murat

Extracted

Family
  • latentbot

C2
  • meltemyaren.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49.exe
        "C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49.exe"
        2⤵
        • Checks BIOS information in registry
        • Suspicious use of SetThreadContext
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:2908
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:820
            • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49.exe
              "C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49.exe"
              4⤵
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2268

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 e5d43ba5167dea7e607c50c79a4c351d526a094cf818f094595439ed6b72633f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 482cba1c187c5b957aeaa647d6e9f8b04021c41a34369ca98f57dc2edc98b75e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9db3d85579a299acbc08d020166e5bddf8984d95bbe194f8f0ad9fb36390245a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ece02798b15c794b71a52415a42f97174c57ffaaa93b3c88e1d165761d47f1bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4a5358d03e71cd0a0622fc1dd5def02f7594c713ec3a0fe0e8666f648fccf09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5f6519909fbfdbb7b3b217dd852302914f21dcca86e117b04d9a10e8a8e5c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc926ea43e5ac62a39ad4da582e71c0ff9749342a2473057bdb173dbabf8642a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc9a9b85eebcd40d259247b210722e0ce0bc195fcffb7c0285dac3636595b3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa13ce7c3518bffe949d18e1c758ef8d2dee0943cc5a30168113ebaf5ab8c88c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 203fe70e5bc2e3f9164cda91a52ceb2ab3ebf93350bbdc5fe9fd89a9ea82f8de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 764b297965738068dbcf0a2a7691324a23fe4ef0da3d296a9e4f8df77f5d40b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ade9b6c3cb40d22daeb9c3e8fd22b2f6a933a57daf15cc82ef87d2fb648f4db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a23ad351a33c84c4304cf95cab8ef9c02674eee40414759d706c739cbf072f4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15316a73c6fbbfe43a4882fd24baa9d094325092d8c7bbe8d6d1078958616df0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47012aac2658835a2a36d0fcfe825ff85ab0552b8a61d6b819e4c3845598930a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a38092f0f7f86d89b80dbfb0de36f7286589553b85fb59e58f5e546fcfa91f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4f0c4d2c4082fcbc4aa240c5a46d4f49774152ed4276c1b9c088aa49e38b189
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed889573355087ea8695cd3d32faa67ea1ad6ea7feee6e84c52691669b3dd45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9af0a62f2ed11da8e519374cd8910a751f0f9b53a975699dcb57228a351e9ecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41dc317b266e293b2e9724be1e882f4b9ae48017340b8256860604132e9ff08f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71a4a0897f94c5e4b9f567c6fec5806667877084ce0b32094a8e35fc80f193ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a55e360b078bbd9bab5534f67940925be45173ff1848a6f9889008e1086427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8395b151e1f9955512bed3c7ccb26ce9d71cf7502fd63be84e5b20858c4d9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 266ea627088abe9027cd256406e3f34b1a8a6b6dae6305a7590144ac16784330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3f2095793b8f4bf694ce6943b89a289e222ff9caf9edb4d40543925ff8879a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d3330116808795137082b401a314f7b62fe223524b8d77f7ab8bc0f2221051a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9789cf7ec7418d160b774711bda66057023c21cb7d649968d9fcacb9b28573d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c75e223b8d05fcec41b0106207cc7371f837c0e87c59d80b58c9fc5b4e1f4a2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac8fa33eb519e481829956955f99e0bfec809f5967e1579574a380e621ff7a9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c156bbcbdd50f153a72f312e0008578bfa242a73c74d402ba24851afb61bb1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5765d04b0174648bf0c0020d2d5098b7a83f5928f720a22e02b8787c6149b4b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cf8875f211c99f1b8fe46f50d29eede7fc19dd6fe259a8324005573817aa232
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9733254a435c6f203e4996e273d31f3cc95c05179e325a6faaba98e9cc67a23b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1acf931993b8c70427a8b70860ec0be8b62dd9ff5d2bb192a22c9cce7e3229d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5ca1c53a446f0d6119e99727df9615ef1f89e843d6d1ca7ffe1535ee2b12b5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747b53cc733057f7824eb3874cb65b0b81e0fe1e8a57c6d9e4c0549e82995884
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ba89be086b8c2cf7be0a0aef458f27c377244edc723d8e8d3e2260aaefcc6f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c567ee5732c0a32a6858cc999efbfe60de9a9900e0a40beb4cc14deef3e8e2cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ede61c77962ae79baef0e33711276020492b5f13045bbec66f2e572e59a288e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1c0972a0e755ae0ff5a3e89e4d55847756bdda7cd4cfd46908c5b61128c7ae1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71479c5591be8e7fae0c69557ead387c33dd1f7a8004e9ef7e50dc3ed0ce7819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f66bea92bf4bd61a5b075e91d19e8c6c1fd3e13921fdd8dc67179b3fec71e147
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c96a8d6183caa7f2c1c9e2315d3044ad96617a8376d76b4fbf5af4d66cb8bdf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2699b20efd8a13351386b267b06b1f0dccc2396bf53c6aa8074fc57a3e73f144
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b39ce258823895300fa99c69bf8cd4dccac10454d87effcadcab89113caa1c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef9c72b175257e6824579b77a1b8b8bded2d58393351c913ac2d4f9f3818df69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58022bf143c4c0da896621c1ede89764681d9fdc6014f32e53ca56a6a049cce9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b742cea8fabd8c1754fcadf9c6b67bcd87308fbc30d7ef82645172b71c4406c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 124fa60278dd4eefcb9c6f159be80dd606aecf32e664a8767bc5c5a577fd30d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24ee2b3716699d0355f81dc3908c5a3defa4463121e20a764774f17c9319c2f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c4f635fdc3d8f8418d92e3ea5626f4569c7357ecc3577cf55611d0a6056eef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02b6fda01b4bc1cfffd7df68d601e9b8e07f59fbeb37f32e5df93e427e0de226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2a3dd664ab97213b5d4bb766d7a906e17b9de0c2d42397efb37f880f8c79c25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d8b47abe38d5476acb4056c6246d26260a1e166fc1b4f6e12fce3144f952f5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db5960102ebdae22161e89b1bd2a5b0c4726bfbe5affc252fdf155bbcea28569
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 714754a59182db46870ee802205dd87acbefe8e79fb94e5b26d6d195b8a87da6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d598aee8a610bf6894f8a05cea277648c344e7769ab2a41f2737720bc965a2b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb6833fba8f896a147742253150ec303584b3ad70623b16dae9ef20255fc09c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ece4eaa339d1cb9b975248c1578bdfcb952a7768dacd04be34885adbe831757
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa57e1c8feb354c5625b6f4333faf3e8c2a07d3d2d7795a5cf480090472b080e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69238456b25fd4f9617b2c9e78e81ccd1a1ba21db2807851d2ee815cb345d3dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dd026ebf827c51948942f4569b62b9112f346b4a8905bff0e572255c3258380
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d503e58ea066c8da46439abcce5d8632d93615f204c8e63ad783f432cc0f4b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 727f1da3f73d3986fb72b40e749ea2c6325ffc810321b31aff434d49dc40c647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2b1a822c59d3227b8dd7b76235a1c03acfe13ca8aac35874996202f82d08ada
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e192a0d422ec3cc746057e30841f3d4e16c022bd8e7847dac27b9f69d17b9930
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31079ed6d6592ec94f60626306255bdbbc8e353fba85b2f196f5ede46812d52a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbbffcf09c19e5fbbfc9017b0d67f22878fa29c82d1ed01b782e1d13c7b46d1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef49f592a050cd7ea1c140d7c001fc713d3e1d9c385c57c375106dabea2225fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b7b78f22e6bd7ecb2732a372da237565a8867ca14574919785c07d71b41d56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b6a632a55e9b2b82bda99f2a685544ad0b5b329d18260906f942cf6aef19e44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5720011aeb591e09af24ed78fe4256a8734517cc7cea2facf889eefbbaa2cc0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c8d33083757fb8e3a105a2959a5334afaf088100daa9e9c90462aa78c856bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af29ecbdfa62e5bbd10785c18055d3cd6faaca09daf1ce92c9d30badd9d256b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cca6adfd593ce56ddfc95f2fd17c536add1d337fbfc09d7b202c8e8f5ccc7145
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0299911eb18c029a6d40e2595d52201a3485a66d63e75858a93304a6fcac402
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e0d63c44b4d2f3f073f3e5c5d2bdd14387a8373ed74a45a3a6e99dfa42c24ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9604d69a86c5a376a08c5da9ff5e9d77d30a03e9eefef35b8f0b65b44d5749d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 286dcfecabd05dd72911b238b3d1a42895a3270f59fa07f5f59d6c401d7d9f5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 232c90ccd314f27ae96c91571cdbd87b66f3d84b41da506903306080487d6c1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 559459ed2be782d6246cf796bf70d98320bcdc327ecb8e2188ee26f8ad7f255d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9865a158573a522ddd8925e5a903bebe0fad1d1a51b8eb1ef594fa4142cfe948
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1f13de3ad9e187a5176043cb09da8e49dd2d1aecec20128b66c48165b922a62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02af8205eda291b2d6ccd9290cf43716e0b3c2fb2023cdcde7033ada84ffca66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2591dee9ac1b109b73e8ca1bbaff1e0ee5562a1bdced1aa1bbbab7593e92dbff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83a143c2ee7abe3638cfd51ed16b0795d2b9abf2895418af22d510b4839129ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bde09d76211997ef85b69e414875ce8c91d86ce79b4dcd8dd49f1ede8d642dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8985ef1474531a265535fe978d2c14fa1222e17fa5b472bf274166c0e1dcc61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae1eb0f6259a8d7c8ca3b0e790aba75d85988e2a6b5427fe564d04d746751b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7da319c7b528d3becd625cb54835070c4ebe479e62731820bee8f4d5185e0337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68ec7a72182ab0e789c23c61e9ffb60e60f604c0a8756463596c7e1bef120f37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 323e405a6dbc6e92842bc2533e459315ee41bb8662da039674404e0be7282a91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c617012d5ca3b1d3882b59858e16ac62df27bbee03047e145aba904b9f16f10f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91c96bcaf09f960a2dbf4906a9cd77f9fab5d70b958fe83c8b21c42315dfb729
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7d7b218a3111c56db5964a2ca1c954700afa30abdadf565975debbeef75112d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfc7c6454c9ba55f4a7c3c8c7418dba0092140aec2c74706798470f7ee881348
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 580382efaadeec9f6f4699aea0e66099d44670c96225e072614e0d305b257d86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c615300814855a65df99744af60dabe7785aa19f6e99565af8bb0f834249b5c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c7bb000548899baa6aead3870ff9f71c0f14a878e67a583aea6c9e9a767fffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f528f2578c0fa86c9f6e09bb1052aba97c00bc5277c7134d1f4f996f5953000e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 643be0896aa8f282f68096945bc36edd4166bf5e80adb6ab7e0dd220ccd5c220
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03b1b9d93196f273e4e750026a4ac7d15699838704dccb1d751d451b3293a02f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32228764c8a1c938d6b3d1e768e5c40df7f712748ca16e5eed940c4216b617f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce2093b66099fe82bd347d9122520b8d23113a1cfa767bd15d8a04c4d7299a45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a47c76f6fde21a85f0230f1474cd6dd2a00382d05af0fe6ef77ac315612e32d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebe3c108543a8c210b8849d86d6dd2da2b0423554714e51ec36444b23cfd4d1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3c3f7495b241d0f0a403852cf70e3e633ba363fb39bab4b577fa3f44e0baf63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a7bce98a274386baca98f4ae32794e58c9cf4e1427184c600fd066e1692839
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d5fca83b81e158c6b90a8af72eeff425c0512bcaaa57242f7c02d0c0deb3ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8db1e1de0205f331bd23ade2a5be045b8f4ee967cf59be1a3272a2b7638432c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8693cea22b6f3c6ae83219bd511aaee149f57a588f7094bca44e657099b6886e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28cec1c8406cb590f2ca2b4500bba7e2cfe608c001a91ba1c7c1d592fc48cf8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dbfd092799d13cf1079f7eba9b23912ec4ddc3e6a0b088b4807b4e607f2ee5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82654036d068bc066fa9d06a498347a4f0ffd6ffe841584314cef5e99d3a3ce4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee69fb54ec4caab9d43c235f793ce9d1faa267a41febecc352b60ef9e95553be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2eda0d74036fd6123696effd5204fed08790f52be0b7bef616604ce55626133
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68426f7c8f243ca0ab59c22805908661219d4ff0e32ddf7de0d84f2384578663
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec65209a4dec42958273eb7e60cdc2cab4174981e9fdd9703af234a3eb9e038d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bce95cc3eef88d28e8793b01b4caf8fdbe7543ffc7c6caca0504503ec4f7e25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81badb337a43c3394dff2b10d7909ebad3db2020eeb37634b5e26032fec7135d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50da8e6d86733d041eadcb8019b50ab8e9dc94636352f50addc56b1aa0355495
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56e45f07b68fcb996d0c4b5bb5e9ef21eb210aac9b5f2091745e3d6b09242e96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1e582be60de91f4b5d59bd78456789ba2fdef6f3b2d0a7375207045ca5ba4a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63deb828292cbec7c0837c5be6e67b98c4032bcd7e0d7a98a585ea76dfb2abab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9daaf27f426c136f75009f87224472dda26e1fa2f760af2501773f1436caf65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e3b0b667735dc9ba6d3e805c0c706d097500517d0566e5e68cb852625318e77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 842d1dd49a0152e246d3845a422dedb291171074c56a72782dbcf124d4226f4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19131bcdc634790808f83ecae406db44347c88a0c93d7ddb271b3c2cd075b9ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14cca4e337584a44a1d2c369c7bf919548b9f657d7019b43bf48e9905080b077
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27a047f0bb178be4065c233c183e79cd96ed1a4792e27c2358bf641ed9d15924
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8d5a9c85155c53f7a82dda32bb094745d2a106f797e2fcf397429ff991e9fa1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e6d5f8a5fd482bbc5ea0a736e3dec29ada7500d20075c9e01142da8ee059e7f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            cftmonexe

            • Path C:\Windows\SysWOW64\install\cftmonexe
            • Size 834KB
            • SHA256 cbc5f637a3fa9467f1c51a986ffc092a0266d7062a80c6f7bbb92ec931e6cb0f
            • MD5 SHA1 SHA512 SSDEEP

            memory/1288-32-0x0000000002200000-0x0000000002201000-memory.dmp

            memory/1908-0-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/1908-6-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/1908-26-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/2268-1686-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2268-870-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2268-580-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/2788-14-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-10-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-28-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-622-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            memory/2788-27-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-25-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-24-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-871-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-20-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-12-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-8-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-16-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2788-18-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2908-562-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2908-275-0x00000000000A0000-0x00000000000A1000-memory.dmp

            memory/2908-298-0x00000000000E0000-0x00000000000E1000-memory.dmp

            memory/2908-896-0x0000000024080000-0x00000000240E2000-memory.dmp