Overview

overview

10

Static

static

10

8bb8cf8e82...ec.exe

windows7-x64

10

8bb8cf8e82...ec.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
  • Size 190KB
  • Sample240403-3a1fpagc62
  • SHA256 8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • UPX dump on OEP (original entry point) 64 IoCs
  • Drops file in Drivers directory 54 IoCs
  • Sets service image path in registry 2 TTPs 27 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 27 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
    "C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:3820
    • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
      C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3096
      • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
        C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
          C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
            C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
              C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2628
              • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4912
                • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                  C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2484
                  • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                    C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4548
                    • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                      C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:852
                      • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                        C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:632
                        • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                          C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:524
                          • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                            C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4228
                            • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                              C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2376
                              • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4036
                                • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                  C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4400
                                  • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                    C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4968
                                    • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                      C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2424
                                      • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                        C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3432
                                        • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                          C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:3200
                                          • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                            C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1568
                                            • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                              C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4592
                                              • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1980
                                                • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                  C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2600
                                                  • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                    C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1888
                                                    • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                      C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3068
                                                      • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                        C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4212
                                                        • C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                          C:\Users\Admin\AppData\Local\Temp\8bb8cf8e8263492ea736c5755155691abc4e4aacd7afe5fa6f9bb2e0db7937ec.exe
                                                          28⤵
                                                            PID:2936
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2124

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 201KB
            • SHA256 69c848dbc3aa77b9ea777de2a7034cc5a3b7e48cbb4c98bf52615c99c350b6ec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 191KB
            • SHA256 4410f3b1fe1782a3b10265f4b815fb7fb70f988a32d55e3dad404e6094594493
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 200KB
            • SHA256 e41f8073eb4ec3bcbbbf83875a5d71aafca4ac098748010d932ef1756bd3f2f8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 219KB
            • SHA256 1788d309f45936f4f9a6b9c3526b260f21461b472ddb69b474feb90748b0cd27
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 214KB
            • SHA256 971fd6af73d76fd5464538a6abea30815d6de8b92622e6ad2d04d6a8c4543ff7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 210KB
            • SHA256 6521b5130d576bac325ccfcd2f19efddee8b7402a03fa954fce30b3073720fde
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 207KB
            • SHA256 b6dca0d0091147a871198bddcf00d54348c452c27a5dbe2dab29e94be4751633
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 202KB
            • SHA256 cef4f06652fa6c427a411de752e6f0719b195b0a4e9955e6e4d111ec68b0bfcf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 210KB
            • SHA256 2dc7160c85caee21d2fc055444bb671cecbf93c3006aef4ab0df92cbe127b1da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 206KB
            • SHA256 87c1e066312f0e4694a00aeaa3f09ed5a2446c75983617f60220578927db8545
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 204KB
            • SHA256 d1e849b4e1abbc1167c9cfa130135e86a6b699e6a4fa5ad1f6df07894d9e2805
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 220KB
            • SHA256 3d9f762db867e93946ecea045e0060b106ab44eaf05644561fa259ba480035b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 216KB
            • SHA256 4f5a6cf49e746bc24656b962fda10fa73acbc5bee936b48bc1e23509c11337fd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 193KB
            • SHA256 fe9acf000a00e76eeccb1a5388eacc952cdaaefaa8ad8dce942e828b93bc39f6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 212KB
            • SHA256 a17a4552c55834091141d507de8fe0b047b8acb26819c293836626281ab44a87
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 195KB
            • SHA256 9d119551dc91c65c6b351a40ee03f32eb25c095e607d07d10d68953633fd62a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 205KB
            • SHA256 b1e4e00d9344f14cfcedac48d8460276ca916fe15a2bcdae6df645d11b58e5b2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 219KB
            • SHA256 0653265883c33c281ca0822a25dfae8ca157f4454ad207fbfa710b70cf8bb1db
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 219KB
            • SHA256 0cda71397029436f329575b79d3a315afc5a57a7f6fbb219242a5b0fd6069457
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 202KB
            • SHA256 d1fc3611a8f85bda5ca6e27800ad6bc147d6a80028bad118916d4f14dc18d05f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cftmon.exe
            • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
            • Size 196KB
            • SHA256 d63f4e0dcc7687cea43fd2378454d945efb70a3218b8fff4d4091ef2b1410924
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 217KB
            • SHA256 6c43a1febf96a7b23564945e8e5cc4e92041dd7b3a5fa05d6d542dc78ccb9368
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 214KB
            • SHA256 99ddf6a5edeabaaae4d16a131fb737fcad18b9a98fbd76aa7766b6b305a304ff
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 219KB
            • SHA256 e6d074e19c0d63f853f59e6a417b3566ddc280a472e31a77b664a9b71291d927
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 209KB
            • SHA256 7ee2b7fdd6064a178d42e36f41e23403c2916df2d2a2621e055e0101c6dedf60
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 206KB
            • SHA256 f8dac7f0480fd50de870292a3475cff2d127d7e274e5f381afbb358f5354a613
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 196KB
            • SHA256 4c5c192c568c1d33ef3b2921d4b51a0d4b499e64908d088f98df64e3c9be8717
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 209KB
            • SHA256 38f09c18d6bad5a44b0e4a53c7e91002da6a22d0a77ffc23ed88c6a65ae8991a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 220KB
            • SHA256 a7f2bd2d1e4acd413bb59e15195e285cc8e21ee0769f066ad2939fa80d913a93
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 215KB
            • SHA256 79074831f57a2f626834bd3b298c6b11778ed8efa86c7695a0ba0a70485e5dfe
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 191KB
            • SHA256 2a42ba170ef9fd816b465b99d3f5b976f4dfc8896e02febc02179eecfd232609
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 191KB
            • SHA256 ad1bca730cba9e71bcc4ea61d44dc2c1f02a9a1462928fb44489fd224efd66f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 213KB
            • SHA256 fbb7cdc67c26870344b27c7a64fec40456d4bb2df721af16c272d46e5a3b4d11
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 194KB
            • SHA256 5d781b1388459a26fb2aab48e4bf574a0c33b21dea635ac49562aae679a3a179
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 210KB
            • SHA256 8606152a18a9aea8f0145a855201aaf3e5791249717422a2f0acc0f9bc8aad45
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 200KB
            • SHA256 390da462794474f3c196be0a4524d84a86cba71c7446eeaf507719ac34cd5c5d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 216KB
            • SHA256 867825120a8f3b86e48b88b7acf48ada5304314f20c4582ce4d39cb644217578
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 218KB
            • SHA256 68045fadf272ce270adae3071f2bac34d40454e43c63d920e35f853426f5f7de
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 213KB
            • SHA256 3629e53429d13c9d7b65e6cf8512583c4dca9cbc848bf470e9665dfd1b3f85ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 218KB
            • SHA256 0a17bb4c2bfcc7306e36f0b18448e7c66bc384f786869955a9ebce13ba7a2ea4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 194KB
            • SHA256 df78c896fb5b4a9e46b99c496548eb3e33978d809fd2890659e8afdc6e9f7c70
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 197KB
            • SHA256 4f80c861fe99313f7b4400cd605270584a304fbe3e81e90ceb870211ca76b726
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            spools.exe
            • Path C:\Windows\SysWOW64\drivers\spools.exe
            • Size 208KB
            • SHA256 1027218ef783a7e6b6eb91c8fdd2d037b69938d30085b21198675e0d4b75d248
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ftp33.dll
            • Path C:\Windows\SysWOW64\ftp33.dll
            • Size 5KB
            • SHA256 708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            stop
            • Path \??\c:\stop
            • Size 1B
            • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
            • MD5 SHA1 SHA512
            Submit Download

            memory/524-148-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/632-136-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/852-124-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/1568-256-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/1888-295-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/1968-63-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/1980-265-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/1980-277-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/2376-172-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/2424-220-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/2484-100-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/2600-286-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/2628-75-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/3068-304-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/3096-27-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/3200-244-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/3432-232-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/3504-39-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4036-184-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4212-313-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4228-160-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4400-196-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4476-12-0x0000000010000000-0x000000001010B000-memory.dmp
            Download

            memory/4476-14-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4476-15-0x0000000010000000-0x000000001010B000-memory.dmp
            Download

            memory/4476-0-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4548-112-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4592-268-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4604-51-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4912-88-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4912-73-0x0000000000400000-0x0000000000430000-memory.dmp
            Download

            memory/4968-208-0x0000000000400000-0x0000000000430000-memory.dmp
            Download