Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 03:07

General

  • Target
    ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe
  • Size 834KB
  • Sample240823-dmc4gssdjb
  • SHA256 cbc5f637a3fa9467f1c51a986ffc092a0266d7062a80c6f7bbb92ec931e6cb0f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • MURAT

C2
  • meltemyaren.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    cftmonexe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    murat

Extracted

Family
  • latentbot

C2
  • meltemyaren.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe"
        2⤵
        • Checks BIOS information in registry
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:5032
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2736
            • C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4984

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0fee3ab6c7eaab8e87bfa425b801a80cedfbe0bbec1a896d1d98c9dd16dfec94
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 7d576e845732e6658ac7a6f749d712f0c842fa86a3f1b82ba4e60a57dd0f071a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fd5105e6c4732828dc7c913b600a7bd674e17e9ac8afb3a74afdc1afaa12f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f5a10a76d8de11c0dab7c0e7991f2faf62a5b2115e90c4df9eb4d5f3d82bf2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 028dc598a0b4a6246a3a01c4daa12dc2552b7cfc4981e13100d80a5ce70604ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bf15026bea99672b46259a29e2211ddb78f2f9a057d60620b23390fb45a0b53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e001ff3c0debf341090dda3504bf6ea9977f0a2a29e76786ea0601596ca2b703
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a420354af9d2f58f7e8afc288a5861c904ed8cb2406f1e21059239f39770882d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c40a82251327e7257f2f730199503c8e2571d70dfb281eea0c09910da1cf0278
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3004e34b2bef4c090527bf35a1ab921a8490b7735d708b1353ecf29ebd20fba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 416295a2399d07d9ae772c57ba6d3b11c56434cb236e7b2d6674c136ed41ff77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eb040a39608b3298ba921670e949f088444efbc3f3efb30f73d21c3f1e173ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6462fabf74d5e7c3610ad256c0d7d6a5640af1d357ea69e15b2c94953f0b8a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5787e852e663c0090d74e567aba8d49ea968bdcfd7632d2e0a94e87e6a8796b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f61a1f1248fe586b262d70e410017fe6f50d20b245711ab2898e024ae142c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f02b52e01b262a34fe553d0ba2e0c8251fa28858c5849e7f0b4db5075e9f6b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6067ae64a90dd6fc0d642fa50df9c84a29f6049eef97e06910c416abfebddbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 769a0f8c83f10e546a3f4624176357d73975bda0a71f5109a84ebd5db3ce4ec2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ea33c1f6bfb9c8b20bd1c88bdd1345b84f134262196d2de5b6c6facd5f8d28f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f39016e12b49349af904e6c0d98067d6f40b93c1f6522532e91c7a88b71f474
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f10f16e8f30c0bf0da257c5fe1a39a5acaaecccfaf377ef11ff9055973c31da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab42d170a6599da2b668c8dd7428cb8db709b6b775df225f4f3e6f85c3529da8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 123f13ed850dfdc49521af70014fdddbb05dd68516c2e18ec0796bac62a1ccfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eef34e481667b2522add93b0057cdd896a1d1090672d39339f4c1bd24963fe13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a62449ce176a26be30437cd594645dc978eac7ea93063bbe1fb55172a120e3d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bdee66d1542bca5d13ea70dc44a3ec3432c2e9072b53fc9438b786a0b333097
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 043da130b8e9debc06b6236b88d79a96138bd6089c564aa0ea8211ddc8f7afa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 823dbf2a3ad7a28c306b4032fd3cec42641cf41ed8d7cf3db7f36af2d726792b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be5e3086a8f53a001c3858c147e7184233539c30ec8522a801d374e749930dfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3168a5c08fcbdea6d91e13e20f4e2eb551091e6ef068129a42e0013163814b2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7673fbb6a532f3e44d3dd782b9c53f8c7ea903f8ecc33e8bc7dc430a9953790
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e14dd25cc1e373205a0b20ed4745fbee975c3ff74071f0bbc8a21f9621960f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb35393cd07f1902ee30fd9fdd1c5d3989ea4d44af170d97c6fef6998b0a04fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f55dc46e2b5619fbf9498eed44d45362b1158e8ec65a43ff49f23856a1528fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b524fa19445ca04c5be3fecdf18bd10f4a897d388707581e01d3c216886c036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59832ef10dd20a9386a6c13b11763df0bb58a34ecd78b7bf2b28967e85da560a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d355c20fdaa097ce61454783c976d91d890224ed65fb2bab6f718b134d310e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8145dad1ba5527156686b749148606bb2616250d37d5029a7978645af45b5bf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffcbe329388add3c44ea2618628e484a89ba1d41cf2cd286738f44ce31a5448c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53bff19b2ea8d76280378a55fe63a8a0493d1316dc6903e1cf0248fd8f076c81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48477a5555d07ac9986ce7849e9d627420d419121d88401c732871542dcd3bf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ad5f68ab5faa1c3c6007680df5052b3c867086cc947712b85c84fc347ed916f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880b4a4f45f9a6964a2533f5ed4dfaabe1b53466207946abfce3aea710401c1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fe5323ccfd639c3f6ca20d197b87bfb7334fd6011b36bafb95f650d29078ca6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a737ac4e361e3408cdcada2bb78198c78fd3d7f1120d8f352fe72dd07f073745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04e6d1b71821cb39ddfe3f21b57ecbfff06b375812b0be897f5ba6590f749dc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 416be5485c2a3c9eebab2fe91911f8487006103d2dc66d091bfb1f440c21021f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecb907546ee6ca899443ebda6135b7830d627de1ef6f266836aeb6dda8b21c50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4994ad33b5d74c93503de6c5daaf216072f280e208de838c1f3a73223c550db7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b0adce03fac1c98aa239e5ffb8b44ff9d60dfad67e76b9d1602b3c760586f59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7be480cc415f15e22776c9922d003af58437fdc87f0cc6d16b0f7d848b7316d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40ded83948f4a577c04876676d487580acc5a60fe014eaaa5a581957d96077c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8b71a4b941caac01f441820e2ae7e2a830945faf4eb404afcd204a2871e93b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02f6be3fb99156c7e82970e23f70caa7d86205fd6ebf3f166ea51a81f15c48d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3567333ef330156b5ed00df381c24118ed70d1d6842ccc237386b07cc2bda491
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8acd074feb261aacfa0579bd2602be9a037d05db38858c55cb04042bd337c916
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 017583ff4fe47c5619abb992e931f393dc67c73541c15c02048f404afe17b770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b1d67bf524069ad68b2594001ac9c6d9b36ccf8953710ecfc62ff9a04064586
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a57d6e969199808a91d982e78db0701aa725a89b02f4793f5a64e4a1c264e558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b4800440a007c3c9e4d60eb76b011ea548b46081f2918e75f6ff5042624efc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe1100a7f77ee15092986b8914a1ad32ac4c455dba4061024e81ec4e0aa74b86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fdf053ab64fc9e6b70211afa6aba10a1a8a2f474c9413f95df7f9ece9cea82a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1e638257b70e20dfd7a605c46c7118b7b88a7703dc9c64092d1582a1bb358a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88006781937375345a3b0f9ee2046ffe33a155d221b382284931d1bc7e6864d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2fddaa31e451a12472ef1d9a69c1caf91bac892a2450ca4850fde6729e22ee5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffc7c7b43e65efeb3389c0376ff23f8b781c2695f647581aa657db35a2c0714d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2b7ddf2a81b67fe6ba727127f1de8e9ea1fed39a61db6fb44e05774917f2e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2f6f0375ccbba93b47c168e86bf37c1a9ad72f9980490f22a34d9a33041b094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb9686b2ab0129a0b965b420de4c76543f88f1e19584bcfd3cb84e830a3d1eac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03c80a676f18e31445a891dd6c9ee9ad94ba6099b5fefbcdd9129862f49f7f52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 038be34a74bd8922e65a6a24836de37eb6600f79ccb16cafe080669181e76b2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31ef350c0ac2a619b7e40dffe9d4680574f1282f99815983d1845746419a95db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc6c09ca8322fc5b9fdf00e00e2d7f92e1d7a12762a6219cb4eee3fac7b4ca1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a645effa4f509e75ebadb7764b9df5898201040a85666f62aa9300c50cb6fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dffde19bd069a551744fc6718cfaeb7de3b5436ed355a8e3051e90cfaff5bbb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27c5d550ffb32ddc48d83e1691c6b8ef066d5304ebe8ad7c0e384a1cc97b887f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89a79a377b72e865ae8a54b78141a9ef02f65e7c1afe32c32379358db970088b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d63ba23d7ef4f2f992acdde78df2d3fd78c631f0104647c4b5d45baa76ee0fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0d518a9f25345e4dd2c3ce842ad80f2501c18166ea542e9b97d663467fa330b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de19a0933b494d1f6d4b61772293bbadc7ed8d19b3925e57c43efa9ebffcb64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf3ab274c49af83a4a1c558f9837e8ba848757206bc0015c65fda76e76f769e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3065256b12d809755f640bf7075c2a13e818dd17828f67210fe9a4e168991b37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20e76e5164507236be477b4a533036d17359f636f4aa083712e7ffd1ada21f89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3a762d6018e716c14ccf921c020e987cc8b4e95e0aed603a997992951d6fed4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a532cd0f45719d62368811e1c3ba1f3bddc27588cd89e24d51bab391482c6e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da965888c73b00bef8e19030e22ceac95d4b6f3a122813f9e900d0e7941889c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c06d74eda02faed5577f0ca061f8fd547de11c363e7c6cd8ee4ad135b6b9425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d7e7971aaf1ff3bdaf2c11bd16aef9803b3ab4d770b68c2f726b411dbd7b366
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e430ca1ca511461298ebece19314557b14179fc914b5552d180977b3ceee4946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfee496727b5ec71dabecc21df32d28eed4275eabb2d9f26956a5a7c110b1698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4dd6ba629eb0c46298526ffc3bae804ff764e9d3764a55cbd0f80717a483bcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81d30155e0ed42f1a40e42ee6154e982d5430212268b4be0c2b6e5eb3ff3cf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7133e2d67e6120f1558a8561e5000a13a520b686c38b053665e70be300f511dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50aad7b383e8d59231124537cd979ea97249775834b13daf8d3aa0c83ea6ce14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1dabfff6b0063930e10a63d980f5008b0c9ee2bac3d482bd9d4417e831e96a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44383c0723e57d918810a38c49935d2cb9b8407f9bf0c3d04e895ae22ff0dc61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 162e7738d2941b0844c324f675863738b139d5674e7aef80759ef577309c6ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1badb025aa5d6723c7fe783a48aa5addae3a93fc274e171b4f8f1e1a9145c77c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59f53fb181ea28f7dc3c6f286059e1e734450477b634699fb2c1f7464d8fff23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bb8703940033f5d433aa804278e23297ee8325c7247dc69fc09656dc4fb7312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed288b0f13942bbe958f586105bd48ff00f22c22fe90a9e4432515e558959559
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1d3a575955701f32e5defea2200026a8c708b991c2441968e917cbf2353c040
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b794ecb2eabeb35b2527f96291c6623bfdc4ec507f24a07f0c1aebf89b294d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67932c992df79baa0b8c0b6394afd6ea386189bd83094b7e43ba1055cf49b6e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a612124c2ee13bdec07ac38881b927522e98dca89a6aef957c074cf9bfb472a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a668246f6529d0c250f3ba4c27bf53f369f709b903079e0bd6679448c1ad011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d56556fb87f4fcd2cce9610a3cf5809729fab1fc4c5f2a4595266828239da38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90141a762533591302abb61a51d9a306fe1cb6173ec2b772ca3dd45bd04aa0cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d1534b5c2b6848e9ba18c4bc10cd999754984e2218925e9fe33f8d1df823d74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 222929aa19ea7126f480a1188feed3b25792e4f3098ccfe4aa10e162bca51ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f30996e8fb3c33a7f445d3ea112ca300f4cae10124f44988deeddbfc81877cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74f05c3bce90762206ce152481094954ae2f848199caf78401353a508ba6dc0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e47551297d35be3c1374d6b5a632b60cf1c1d21b6a7f40b5b4d0bb8773988bfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b748d8870d2c7e2f0d65ec6afed095bef3858baaf405f2a6addf1842e7dde4a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25f6cbf091ead3e43dfa6a54a5059daf0a97361005cbe8f5000b5cd87d58059b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 befb4b698cb3dabf651fb35036e64e74a6f04530585d548ac28e0dbcbcfbfb9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17152147dff4725454b0c8bbab62725a25411cad2f9e83f56dda21b2ea81449c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebfa4b13bb2b2c3f889359293cc4218b139aaad0151f114cc623ea7054ef539c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f26308ca0cf360c68ed8d57ce105b86e5d952e1b1c02a1b98cc58fc531154f5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f712a79c4daa6b7fdf92dff4810221d2df9ffb30137c4060d42564674b865f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 499530dc92f0761d9fd7430278624cd169f64b14f835d4d12fac58c92f776dff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c362e18b949f543669a6c6717522577176d4649e4d5ab8dab4e90e653e67232f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9481c59485794a5f05c57c953af035c78457e1f0c93766791958f70da3d8b100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b26865da4c82ca940ed17eef18a05bb71ffd1d315b237b4aacbc4d03a073ea7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0d0992d80303364c21d32b4597bbca40128c185d1438fe90eb06a3b98b4c2d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe0a30e8380630363affc04a127b2dfdcc22c6148df06cbfc7e8f75bdf8a7554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcacaa515caa5b0c3767dc20db0817ceb9f43bfee4766259608e6906b3cf9fab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ffdad9e038a25ba40a8ca9f8fa5ff282f36d14f491366251d2bc4778db7bdae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a258d4357069db4f72ec961867228223986aca7ffd03fc663ac345fd08c5403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 292032883cc468ba920bf9b18492f8c958b9406de823e58e6380221ffc72d1b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5871cff796fdbcb5111d965ab737501c7b2d55adf8cc5b264a013d75f3d1044
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1877f5766eaf9231bca3c3c54757d1c200ea54783fd8feed702e51285af2a00f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41ad3d4070ed1a223eaad73827759aa749c9121945e5e1657d846fb1577d0836
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bd0a4d528114733b4eda105f0d698ce133a1230fc0397f320a08f6f929d6485
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b61b8a4d5c65ce3525cdb87dab7daab724067e823d65424715e2d8405617d13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76ca87932c7fbdceddb18c85e77d06c74f418642e64ac5c48e4c5cd35c64c796
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d38073c7d692c3f9627c906c4f691865d18f9f0b71b2a5fe208e7a9052b61159
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0735e819dc7694870d10c85d3fda0dc1409cd46523d521fd0a215855b7fbdc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 208e6455ae8a5ae0d8e2e0695e1725ae2d055b72fa2fa5bc0a47f36adf664cf7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            cftmonexe

            • Path C:\Windows\SysWOW64\install\cftmonexe
            • Size 834KB
            • SHA256 cbc5f637a3fa9467f1c51a986ffc092a0266d7062a80c6f7bbb92ec931e6cb0f
            • MD5 SHA1 SHA512 SSDEEP

            memory/3068-16-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3068-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3068-20-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3068-154-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3068-81-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3068-8-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3068-10-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3068-11-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3264-12-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/3264-13-0x0000000000401000-0x0000000000421000-memory.dmp

            memory/3264-5-0x0000000000401000-0x0000000000421000-memory.dmp

            memory/3264-0-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/3684-155-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/3684-183-0x0000000000400000-0x00000000004A7000-memory.dmp

            memory/3684-184-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/5032-21-0x0000000000D80000-0x0000000000D81000-memory.dmp

            memory/5032-83-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5032-179-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5032-22-0x0000000001040000-0x0000000001041000-memory.dmp