Overview

overview

10

Static

static

10

ebe717197f...fa.exe

windows7-x64

10

ebe717197f...fa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2024, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
  • Size 348KB
  • Sample240322-b619baef47
  • SHA256 ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • UPX dump on OEP (original entry point) 64 IoCs
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 2 TTPs 28 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
    "C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:4876
    • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
      C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
        C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
          C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
            C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4384
            • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
              C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5776
              • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                  C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5832
                  • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2144
                    • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                      C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3612
                      • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                        C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4892
                        • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                          C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4496
                          • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                            C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5272
                            • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                              C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1000
                              • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2684
                                • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                  C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:5072
                                  • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                    C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5636
                                    • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                      C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3224
                                      • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                        C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:2832
                                        • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                          C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:1252
                                          • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                            C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Enumerates connected drives
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:5268
                                            • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                              C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2204
                                              • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4564
                                                • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4496
                                                  • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                    C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4060
                                                    • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                      C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4556
                                                      • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:528
                                                        • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                          C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4708
                                                          • C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                            C:\Users\Admin\AppData\Local\Temp\ebe717197fc4cf26017678e09e1cf478f9a92ede908aea895f3aea5d129cf3fa.exe
                                                            29⤵
                                                              PID:1552

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 349KB
          • SHA256 aacccc43a831310f9bd7a2457f2f75f6407eeea708dcfdf301eb2051dd3564ec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 377KB
          • SHA256 4c35cc0f998e00a2c5ad73760f5d9a99eaaef5016c8f94a82ee46e89b6fd7093
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 351KB
          • SHA256 7a30f0d05d05ba20968028aa1bcea1081ddd2f3db975b3dbe29dd095c13d0820
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 376KB
          • SHA256 d0c12be1f3080e33977c2d2e543da934bfaa3ce5b8f14f2a1ce2c2ccbd47db3a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 375KB
          • SHA256 342da1a86141fb5f0fb1e29eec02a25b72e37775e4e5f1f973931a06874cc679
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 350KB
          • SHA256 b5be43f9987de136da76e5d185d1107996837720d502327728f7afd099bfb6b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 350KB
          • SHA256 6f5205c585d1e69aef074d8de0641bf84949408ad78fec7363a8ef69156e7ec1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 332KB
          • SHA256 e74ca0956278e757226f7d419f3c36ef8d0ea77538e391a045dc8189d4c5aedb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 365KB
          • SHA256 79db74a9fb580c395d32483f4b546c75243dc2dd93062e42f28e07aef05a2b1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 376KB
          • SHA256 926bc53636b93b2c90e2bd3cb49f1a499896e34682e9600139e7e2fd0e2f86ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 376KB
          • SHA256 c1075d6f91b91c636789e288b1dd2af7f1d8f63e759ee5123efd0f142e204361
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 378KB
          • SHA256 0971bae3bbb3a98c353189d1887a60d562e1b0c39fdeb06b28b6635c2c1ef341
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 378KB
          • SHA256 7a60548e04d7c099051c7743c3aa7c3e1f538bc639db8c72990e3cfceb9bddaa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 354KB
          • SHA256 4c3286e940983815ffb2d54e6eff5c943edbdefce9d6c81846f8346aeeb32dc4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 376KB
          • SHA256 533100f4638fbac58fa5f67780a36c7ad99d2e788cc3926cbe870de18fd6f89c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 368KB
          • SHA256 1d2414bf44cb576e15c83df8cfdf30495d4f73b25a5fbe8067c245ba881b1f67
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 360KB
          • SHA256 237415c343a9de8b26ff49ba39723869510562f97ae8d5eaf61550fc31885c9e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 353KB
          • SHA256 98eda98265d6124af118c68de56d5900a5ef40b255b6702b7d16435e4d451180
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 349KB
          • SHA256 98356f4a127a77252196a783a15139c07758fd23383743a6d2cf940834f278f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 367KB
          • SHA256 f6264d5c58454e3148929dc78035559d22ef5b6fd47b3a33d4cfa55c5106106a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 365KB
          • SHA256 86b80bd0b3feb249c6dcb2fcf77d6b63e2bff09344e1499a22ddd9a4c69bbf24
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 365KB
          • SHA256 847b71539589cea92534fe1e595bdb9b0bd0259642f54cf6ce6bc418f4a7d5fb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 370KB
          • SHA256 fd5cc66bb045f398d5f5ef0b9b6665c41d137e1f3b55f785929e5fa7fe6ec4f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 354KB
          • SHA256 af59cc5906c040fea2c756b2e4f4f0ab4cfb7e64e1cde52ab8295d194175984c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 371KB
          • SHA256 4966fa6b556a11f5cf8dc1f693e3a5de205144483b41471caeffa57da90706cf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 352KB
          • SHA256 8791cea309c47fc83cbd965ff16e29105167671f5c1481c5494f3892cffa424b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 363KB
          • SHA256 525b06c27790f2dc8e8b6bd4ef0ec2dd7fce8f92ffa4cf1c93c243bbb47d62dd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 363KB
          • SHA256 b420e8bad9ddd31552d926c1fda945c91136ff9470b0935bd75cdadef052d6d9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 373KB
          • SHA256 9c0085297213e422accab0f1926de568c4fc3df63024242c84020abaa108c53e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 376KB
          • SHA256 88d579a7fbee03ac8588a42c2503ade601ef5953bf37bb210ecb40ff62da4b32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 371KB
          • SHA256 e07726fd5684a8fe795ade846caf91cdda35e1c38f908710d739453d2cd6f7a4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 368KB
          • SHA256 443425bb8ed88bb318407d4115dbcbc59a4e417883c9f9c0dc59938ac017d469
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 373KB
          • SHA256 97b48af034c04c79138a0156dbd707423c1ae8089f88276dd4c66e6d24416a36
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 363KB
          • SHA256 09183550c511eec215b30833e100655d7417c5bc79f8ba2c7d4e206928f6a3a9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 350KB
          • SHA256 7657aadd46d8518c96685a9c90ea9266a79ac3358549747e37ba202c16e4a1f9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 379KB
          • SHA256 83a01c3fc733a11192e5f158d56ebb3768ee43b48d9b0be85d8f27fdd9dd2c50
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 363KB
          • SHA256 7bb5361974490fab67a1838c0350e784c548d454e6233215895dd3e7bcadcd74
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 379KB
          • SHA256 af1bef69da279382f8992945d1fda9c5ea940e091c68279c2a882a0f67265372
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 368KB
          • SHA256 e240313b0f9d626de59b5613a40a21a6adbf6681cefba62f732fcfa124f027f2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 358KB
          • SHA256 ac4cd186c15704edb4901b2aff7c8607efa6bb022df927614e7b045796e3084b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 374KB
          • SHA256 61bacd6866c28cc3bd9dcd051addb7a1d9335cb83e79285667af49e0dc9ba695
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 363KB
          • SHA256 5f17e8720c53842c0faca3f8947a357190b661e3b178c33af3d8802c9915a6e6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 355KB
          • SHA256 a902eb9c127bfe90907a61b816d45b26282734090f8f3ddccbeeab2c1bb7963a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/528-314-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/528-325-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1000-177-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1000-163-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1252-254-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1552-334-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2144-113-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2144-98-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2204-277-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2684-190-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2696-48-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2696-33-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2832-241-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2832-225-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3224-229-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3224-214-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3612-111-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3612-126-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3724-0-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3724-9-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3864-18-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3864-35-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4060-305-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4384-46-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4384-61-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4496-296-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4496-152-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4496-285-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4496-137-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4508-87-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4508-71-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4556-315-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4564-287-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4704-22-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4704-8-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4708-335-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4708-324-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4892-124-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4892-139-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5072-203-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5072-188-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5268-266-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5268-250-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5272-150-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5272-165-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5636-216-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5636-201-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5776-74-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5776-59-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5832-85-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5832-100-0x0000000000400000-0x0000000000430000-memory.dmp
          Download