| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20190915 | 18.4.3895.0 |
| Baidu | Win32.Trojan-PSW.Agent.b | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_90% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20190915 | 2013.8.14.323 |
| McAfee | Artemis!BB9EC3E2AAC7 | 20190915 | 6.0.6.653 |
| Tencent | None | 20190915 | 1.0.0.1 |
| description | 0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe 试图睡眠 221.81 秒,实际延迟分析时间 221.81 秒 | |||
| file | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| file | C:\Windows\System32\drivers\spools.exe |
| file | C:\Users\Administrator\AppData\Local\cftmon.exe |
| section | {'name': 'UPX1', 'virtual_address': '0x0002b000', 'virtual_size': '0x00004000', 'size_of_data': '0x00003400', 'entropy': 7.842022912472796} | entropy | 7.842022912472796 | description | 发现高熵的节 | |||||||||
| entropy | 0.9629629629629629 | description | 此PE文件的整体熵值较高 | |||||||||||
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
| section | UPX2 | description | 节名称指示UPX | ||||||
| cmdline | reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f |
| host | 114.114.114.114 | |||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell | reg_value | Explorer.exe | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit | reg_value | C:\Windows\system32\userinit.exe, | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ntuser | reg_value | C:\Windows\system32\drivers\spools.exe | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\autoload | reg_value | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath | reg_value | C:\Windows\system32\drivers\spools.exe | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser | reg_value | C:\Windows\system32\drivers\spools.exe | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload | reg_value | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe | ||||||
| 进程:潜在的进程注入目标 | wininit.exe |
| 进程:潜在的进程注入目标 | csrss.exe |
| 进程:潜在的进程注入目标 | winlogon.exe |
| 进程 | system |
| ALYac | Trojan.Crypt.AS |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Crypt.AS |
| AhnLab-V3 | Worm/Win32.Socks.C2667 |
| Antiy-AVL | Worm/Win32.Socks |
| Arcabit | Trojan.Crypt.AS |
| Avast | Win32:Trojan-gen |
| Avira | TR/Dldr.Agent.agl |
| Baidu | Win32.Trojan-PSW.Agent.b |
| BitDefender | Trojan.Crypt.AS |
| CAT-QuickHeal | Trojan.Generic |
| Comodo | TrojWare.Win32.PSW.Agent.NHG@bi2s |
| CrowdStrike | win/malicious_confidence_90% (D) |
| Cybereason | malicious.2aac79 |
| Cylance | Unsafe |
| Cyren | W32/Socks.A.gen!Eldorado |
| DrWeb | BackDoor.FireOn |
| ESET-NOD32 | Win32/PSW.Agent.NHG |
| Emsisoft | Trojan.Crypt.AS (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/Socks.A.gen!Eldorado |
| F-Secure | Trojan.TR/Dldr.Agent.agl |
| FireEye | Generic.mg.bb9ec3e2aac79587 |
| Fortinet | W32/Socks.NAK!tr |
| GData | Trojan.Crypt.AS |
| Ikarus | Worm.Win32.Socks |
| Invincea | heuristic |
| Jiangmin | Worm/Socks.cg |
| K7AntiVirus | Password-Stealer ( 004bc3bc1 ) |
| K7GW | Password-Stealer ( 004bc3bc1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Worm.Win32.Socks.lgLL |
| MAX | malware (ai score=84) |
| McAfee | Artemis!BB9EC3E2AAC7 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.jc |
| MicroWorld-eScan | Trojan.Crypt.AS |
| Microsoft | Worm:Win32/Vigorf.A |
| NANO-Antivirus | Trojan.Win32.Socks.ddcdzy |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM11.1.E571.Malware.Gen |
| Rising | Trojan.PSW!1.BC5D (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Generic-S |
| Symantec | W32.Mandaph |
| TotalDefense | Win32/Ruternam!generic |
| Trapmine | malicious.high.ml.score |
| TrendMicro | WORM_SOCKS.BL |
| TrendMicro-HouseCall | WORM_SOCKS.BL |
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x0002a000 | 0x00000000 | 0.0 |
| UPX1 | 0x0002b000 | 0x00004000 | 0x00003400 | 7.842022912472796 |
| UPX2 | 0x0002f000 | 0x00001000 | 0x00000200 | 3.0150504883289093 |
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
| IP |
|---|
| 114.114.114.114 |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| bublikiadministrator.com | A 193.166.255.171 | 193.166.255.171 |
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
No TCP connections recorded.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts
| Name | adaf0f80b6d4488b_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 642.7KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 5d4b08ffb0f44f0e499e92c7c90b4b6d |
| SHA1 | 0c51eaadb1588a58fbce89abb63b544b650c4f7b |
| SHA256 | adaf0f80b6d4488bafb0b88ad11151c6afdd9424558a64a4a45accdc7c77a470 |
| CRC32 | 3A82D254 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | aeb96a5442714878_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 648.5KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | d4d5d500e593d5abacf4b7cab101f2a8 |
| SHA1 | ecb8e48ae8864658084ecce043502c631c783d8c |
| SHA256 | aeb96a5442714878e949d0c5b6c77a3082c3ca3b9c25544f5e68e40e881db782 |
| CRC32 | A6BE3609 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 7fa603deb7aafc35_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 624.4KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | ddced9f8a0f9eb3a8e1df84fd24bb64c |
| SHA1 | 3363a68d3f115522075a290a4b30af3d32b0f3e4 |
| SHA256 | 7fa603deb7aafc3514685cfdeb8e7c8b85f3f2219aefd423c4f61c7bdb37c135 |
| CRC32 | 57E54130 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 1e5382e0a3ea45a2_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 643.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 9820708a1805604cf5968b2ea46a6bde |
| SHA1 | d9caf9aaace8ce5fbbc72e7490219ae2d388de68 |
| SHA256 | 1e5382e0a3ea45a2c1d83723f6c4294d68451ca9c764fd0d77b4c6f5065735d9 |
| CRC32 | A7F84430 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | ec1302476f8f4d04_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 626.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | a41fd8bc7d022dd42e004609e4c84ef1 |
| SHA1 | f662ae8eee3ad6e7d4d18bba7215882cfdf3d774 |
| SHA256 | ec1302476f8f4d0472f372c04ba2ff7fe46cb6b8b1d3fc9596d463e5cafca259 |
| CRC32 | 8448DAFB |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 13a3e6511a02ab86_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 633.5KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | e601a81a351e7f4f5b70342a825e868a |
| SHA1 | 8e19ca6890be43f00195f6dd18eeb4110655fea7 |
| SHA256 | 13a3e6511a02ab860515bad3595d794f01027805ebfb3f28f0b0c203adbaf5e8 |
| CRC32 | 80A449FC |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | d6c39d8b2bf83043_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 628.7KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | b14add3a9104c6c9620a75464d3f39bf |
| SHA1 | 912f6cffaaff873f0323fcd3249cfff9299efa62 |
| SHA256 | a0e706b1b40e3c9f6b97a50e890154fc6086cec8bde7ce9a01d9514c7d697201 |
| CRC32 | 2A0DEB9A |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 40978d7cda802895_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 648.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 7c58fe55f104a3d12bd5dd5b91624a42 |
| SHA1 | e5d4843000dd74ebd4ec1c66e87b70cd058c5529 |
| SHA256 | 40978d7cda8028955568d5ae9a69de97d582ffa7b60609676df7f9c6c3978370 |
| CRC32 | B2B2FEEB |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | bcc8b10aeb1fe102_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 617.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 1acf6f4c25819822e4f0e1d235d38d49 |
| SHA1 | bdd554d0ce47add750e88b45b4eb19c410bfdbf5 |
| SHA256 | bcc8b10aeb1fe102d39034da486aed48f4e9388f690bfc01f23e1317567a9c8e |
| CRC32 | 7C940BE8 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 2045ae5c370fd4b2_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 639.9KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 6c957bfe2b33085d36cb0e750dd22645 |
| SHA1 | 6323d4d6a74be16ebed0ba9b90a5f231ec12609b |
| SHA256 | 2045ae5c370fd4b27183d831cade8bb9d1b6812af03b71e338dcb15e037f2fbb |
| CRC32 | 5572723D |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | edddcbf2fd0fe2a3_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 634.7KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | ad9672dbbad9071e20824fee949a5424 |
| SHA1 | 4e2451b42271937fd5327f7b4851e9df214c6a17 |
| SHA256 | edddcbf2fd0fe2a3969a9ffcf04b49f63bc0735de295c61a8329705fe1becd5d |
| CRC32 | 53784EA0 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | aac29207c20174ef_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 647.3KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 40561b735748960fe1925593bcd1f901 |
| SHA1 | 8513c1149218e92f52f80156d44df31752a84f3a |
| SHA256 | aac29207c20174ef27c38d0e40cfd94360f515e90c2423596e683a1db22ff494 |
| CRC32 | 1555AEE6 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 64c50cbbd8ee4582_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 648.7KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 3b5c5ce923396c9171d948a7bd3aa606 |
| SHA1 | c40abd15bc3708e7ec8f5e7e0a19cea071e72e4e |
| SHA256 | 64c50cbbd8ee4582a017e4125d3208aefbdb8ce5c798475ce6e6aaf4818206ad |
| CRC32 | DDE4E88E |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 6b86b273ff34fce1_stop |
|---|---|
| Filepath | C:\stop |
| Size | 1.0B |
| Processes | 2328 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2452 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) |
| Type | very short file (no magic) |
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| CRC32 | 83DCEFB7 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4a7699176ae34aa1_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 620.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 8732962b6aa3ccb805f0d6d7d8c1452a |
| SHA1 | 525d4e513e4e838c6579a6a9d6192b2742e56abb |
| SHA256 | 4a7699176ae34aa1fe196febf8dfa8c0fc0bd2af55f4b96921906cce1241d7d0 |
| CRC32 | 6ADB6B7B |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | b8250f4b7bd82563_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 626.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 8c13f63f6d527226962826240817e64d |
| SHA1 | edd52cc269af758232405e82e3837d28ee4dda1a |
| SHA256 | b8250f4b7bd825636237e8586eed4835bc749207acd8cc08dcc468b8e9dad376 |
| CRC32 | 59885E9F |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 6cddf76c92cf17cb_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 640.3KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 661113b3dcaae1d949e2cf34d7f00ffb |
| SHA1 | bc49e64775048cdf62e9917d86d0c441b7393b08 |
| SHA256 | 6cddf76c92cf17cbb9e4b67dd9a798c6f6c11e9550b1dd3e3d2575a274b6cf87 |
| CRC32 | A5EAFF63 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 887643d0207fd59e_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 631.6KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | f65b76609b2f234bcb9688248ab211e2 |
| SHA1 | 822ece044cf0dcee4b78d0b5850ac9137db3666a |
| SHA256 | 887643d0207fd59e3c9fbe879b536b5949fd19d47c6196d1e90ec551eb2b8d72 |
| CRC32 | 003E3DDA |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 44963d0e0548557f_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 626.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 97b087a3d49921ac0c61390203316d5a |
| SHA1 | ce28395a9150e322875e00b1c4d6074a228705c4 |
| SHA256 | 44963d0e0548557fbe0ab9e6af0fa21c30b690e4a4d409d7e9fb7096c666b333 |
| CRC32 | 3E9D5712 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 9b71a098a09cd05e_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 635.6KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 2553160041123ab3927927665f2cf3e7 |
| SHA1 | 5acb18039841297a8985d5c6f65e87a11d957b35 |
| SHA256 | 9b71a098a09cd05ebda1cb7fffd03670f95d7b87f3cb1626aebbb8ddc5636878 |
| CRC32 | 2B659382 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 668860b910346deb_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 626.4KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | f77b2c9d7090f3f5c96dd43167c3bebd |
| SHA1 | 3be7d8e8e59c90b31223d9c4b2ab7f9ca283afea |
| SHA256 | 668860b910346deb027e477e19f06b96b3837cf944b8794ef36dbe3eebcac24f |
| CRC32 | 74B9443A |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 8e6262cfd738669e_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 624.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 517f87ae33647187d8cb9136a1246238 |
| SHA1 | 3f86341b3de8d9904a06bdbf54f48392725bbeee |
| SHA256 | 8e6262cfd738669eeaad648b2bcd4c8b2be9fe7ceefff8ceb1cb4ba67707c9e2 |
| CRC32 | E962DABB |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | e804904f06332223_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 636.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 54160f16af8bcb0bc665ce05260f44af |
| SHA1 | 8feaedb77e0050e334122035f2909af290b363f5 |
| SHA256 | e804904f06332223d641c524e63e49de885f75b79c7a6898ffececdc549fea2b |
| CRC32 | F1C56795 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | e7f403395d2e54b1_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\cftmon.exe |
| Size | 618.1KB |
| Processes | 3028 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2328 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2452 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2448 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1840 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2496 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 488 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2008 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2720 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 944 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2584 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2400 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1384 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2416 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2876 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 504 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 792 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2164 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1916 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1272 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1996 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1836 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2100 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1724 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2624 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2816 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1864 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2848 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2324 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1808 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2504 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2460 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2376 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 18af5e5a08844f7be5e1247851e7deb3 |
| SHA1 | 02e9794f31e872eecd46d6a6561a533615367478 |
| SHA256 | e7f403395d2e54b1ff1b89dd1b63cb9d88801402f10226f0d54a88009cfacc76 |
| CRC32 | 7020CE6C |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 5dbe1dbd7079475f_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 636.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | c84abf08bb8a2123cc5c2609faefd1ef |
| SHA1 | b5141238cfaffae10bfe14d0fd7a5fd9de0b10ff |
| SHA256 | 5dbe1dbd7079475f4eabe56caea437ef9d81eb3227320a09408b65dcf06d6c99 |
| CRC32 | 510D295F |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 8ebcd0679373983e_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 641.4KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 310171ef2434cdcf56d229b45feca3e8 |
| SHA1 | 7925a56416c5e25148fe2ad7dd72021096f656c6 |
| SHA256 | 9543f2a9e8dbddea919780914bb27067592a727588f1e72969fe9dec4526729a |
| CRC32 | F0D60002 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 77834a2f91eb43c6_spools.exe |
|---|---|
| Filepath | C:\Windows\SysWOW64\drivers\spools.exe |
| Size | 640.3KB |
| Processes | 3028 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2328 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2452 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2448 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1840 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2512 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1632 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 736 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2720 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 944 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1136 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1064 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 856 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2876 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 696 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2164 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1916 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2812 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 3068 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2156 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2500 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1836 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1056 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1724 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2624 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2816 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1864 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2848 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2324 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 1808 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2504 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2460 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) 2376 (0900af2a17b9819182f738dcb74ab9e3508422107e2b48fd0d7a4b2fbb11dd14.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | b1bce1ffcbb71f126ba7e717ef5abc86 |
| SHA1 | e40557fb6e80a0866f2a750f93f38b3e4ce1a339 |
| SHA256 | 77834a2f91eb43c64912bca7d713a22170647b6c50d912c2cd92736203c41604 |
| CRC32 | 86352B0C |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 6a1752656e7c9c43_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 638.3KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | da13988f7318b23be4ebc67615ba7c91 |
| SHA1 | 168dff11b19ca7f5c7f8e948552a5d406dc4d8a1 |
| SHA256 | 6a1752656e7c9c43711d00e72a5c38c4ecaebd4d5c97fff17fa01dafa67c3e0b |
| CRC32 | 01016922 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | dc33f75e8f428808_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 634.3KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 190d2e55af16779f829a9239d445d054 |
| SHA1 | 0153b9ab83a800c0783f93799a5b8cce08f8cddd |
| SHA256 | dc33f75e8f428808c1b4518fd06e48389acfa6265cc8b2d3575d5d7baf243f49 |
| CRC32 | 59C862C0 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | adf97988c7fdfc3d_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 619.2KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 1f192aa19372b7efd7ed89a5c0d29c60 |
| SHA1 | 12730f22bb89dff8fab3d1cefa2fe0a823f82c0b |
| SHA256 | adf97988c7fdfc3d694419bdee6dc4e51a5ce770aa6df7ada284ed22742efef5 |
| CRC32 | 6D0FC66D |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | afbcc0221b1aef15_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 618.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 5003382c4dfd304bb43d496da281a26c |
| SHA1 | f67d85f720dbc21c0cbd66a2d1a11eb89f2bac0d |
| SHA256 | afbcc0221b1aef153725718926fbd08f0a9042055b674dc8e4fefa68c1de7fc3 |
| CRC32 | D9B6D295 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 148c5a6898b47ce9_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 620.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 70b5369cdc571c41993b24cff0835dde |
| SHA1 | e0481b941bb38e6bfb6d590888f04c0661750d29 |
| SHA256 | 148c5a6898b47ce95963fe44f86d180a209a359d763bb35fd5ebac98923a9e7b |
| CRC32 | 1681AF1E |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 5717d266831a14c3_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 636.7KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | f0dee43de046cd7563ced394582047e9 |
| SHA1 | 75375325095836bf0d42d8b9d4defa76ceee5c07 |
| SHA256 | 5717d266831a14c34820785357211bd25f496a884aa6727220d30bce245bf1d1 |
| CRC32 | E1858022 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | 58c534d43e88e05c_cftmon.exe |
|---|---|
| Filepath | C:\Users\Administrator\Local Settings\Application Data\cftmon.exe |
| Size | 644.9KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 793cc3e2819e767d0331351af92ba6f4 |
| SHA1 | 72554e63ed0338623c3815cc438b277dcd7e7a70 |
| SHA256 | 58c534d43e88e05c638aa85d1fa71aa9c3c38217d48a327a19b682a9a5fff4bd |
| CRC32 | 9D2A6763 |
| ssdeep | None |
| Yara |
|
| VirusTotal | Search for analysis |