Overview

overview

10

Static

static

10

cae8091061...ad.exe

windows7-x64

10

cae8091061...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2024, 01:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
  • Size 76KB
  • Sample240412-bykllaef4v
  • SHA256 cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Detects executables built or packed with MPress PE compressor 64 IoCs
  • UPX dump on OEP (original entry point) 30 IoCs
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 2 TTPs 26 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 26 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
    "C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
      C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
      2⤵
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
        C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
          C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
            C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
              C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2204
              • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2908
                • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                  C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2876
                  • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                    C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2632
                    • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                      C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2732
                      • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                        C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3932
                        • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                          C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4368
                          • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                            C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Enumerates connected drives
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4432
                            • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                              C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2328
                              • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2348
                                • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                  C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4024
                                  • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                    C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4828
                                    • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                      C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:1944
                                      • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                        C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4108
                                        • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                          C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4120
                                          • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                            C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4700
                                            • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                              C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4004
                                              • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1280
                                                • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                  C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4856
                                                  • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                    C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:944
                                                    • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                      C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4804
                                                      • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                        C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4596
                                                        • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                          C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          PID:4372
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:5008
    • C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
      C:\Users\Admin\AppData\Local\Temp\cae80910611171b388b9f84b69b2aacecd82bcff9f6f2cbd477c490b2a39fbad.exe
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      PID:2408
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1676

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 86KB
          • SHA256 065d9ade96eef14aad04e200354a32ffdce7b5566d4a3bd5458a298ae9fec414
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 96KB
          • SHA256 21b40bcd2f3d76ad9e35f2ec9fc784ca3c6fbbe9276d478fcc6289629854edfc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 89KB
          • SHA256 76dd4690c8e719d3d0b00d81f07a0f8e92cab473079d75afd1e511b230bc3b7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 78KB
          • SHA256 3a7b22738e2e216ea2d5a3e907f8915b507c97000eb8a96a7c250a7b6ab523d7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 100KB
          • SHA256 a5abcb5b9d6fdac6680ec12fe78f510e3d816879c87e2cf6995b0ce3206e5ab5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 100KB
          • SHA256 bcb39d3799459aa93fdd7b067542e54e6ccfe8bd1f52d6629f16da3dcb6ffa18
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 93KB
          • SHA256 a2ba3f64c89df0003a35a5b476cc85fc3ffcb14821d7ab499451ab2e82df8f58
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 80KB
          • SHA256 5743be7b0e5f51d5444a55eb26829cdb5a37840a0fc9d070cd34fc0216c0a8fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 98KB
          • SHA256 e85fcd7cdaeb643b902c64ae84ac8e971f388ec6e18877f834c939dd8eeb5401
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 104KB
          • SHA256 964b10c44b1f8951a09455f1fb2410dc94346a6376acdf725fac77ba5a00530c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 99KB
          • SHA256 b2fec063d16cc069579100e23b93e0a08ec91eae4cd0b14c8e51702d91c6c850
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 83KB
          • SHA256 16f89a8c50f876dfd1ae38bb21acbe42c6087f0fc54bfecb75e14da26c2f5f11
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 102KB
          • SHA256 20b983c4da4181ca92db620a490157454616abbba65948b3a4a6772fe3b4e5bb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 86KB
          • SHA256 f7a3884a9fbe93a73262abaee7f11c967ea0975e6ea020cdce0537aa999f652f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 93KB
          • SHA256 a62046f933d90e34685d08d71a35e8827c855a54a9de38cf4ecdc5779823f65d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 96KB
          • SHA256 f559681cf35f2da92c71a62c6496ba896c10987abeb711ce69e74a373a4caf99
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 100KB
          • SHA256 cd10eedc2f5189768812af46073deb171cf99eb73476a41163b8b183d8cca147
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 104KB
          • SHA256 09489bfaeed64912b4b46c0f4ae95a8f01c00ce3b4bab37167f2fcbab68674ac
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 77KB
          • SHA256 84293084b0feceac73aeec24e43f3fcc1d84c24e4f16219222bbb26c8b6c8a39
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 106KB
          • SHA256 92ef4213e63cc9eb671716dca93b22c33ef912e65a4178d9a03d833c8652c958
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 93KB
          • SHA256 4e1d94f4c50f7180c86bfe77d1ffc281e6501792c10ba753029484f183113865
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 92KB
          • SHA256 64e11c9b1eb6ed0b31c29f8df8b0d1f93dd80a5574fae1d4ec4523c8fd18e921
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 105KB
          • SHA256 e012d5231f3f428412891def02b51d7d5621df5262ad7107e93503faa1388ba2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 105KB
          • SHA256 4ffaf0d161f0e8d93c9864909b1c08dfd262e4b29c1950679a843c7069139808
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 84KB
          • SHA256 ce1b524e3ecadade8dfbecea99267c7765c36fa12bebc9b2ff192585added2db
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 89KB
          • SHA256 3229e65c20901df2fb03ca93aa5b15be8da717e511f46d291fcd3bb89d62ff32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 92KB
          • SHA256 1685ff3f879fadc8052cfe20462d4128aeb22f4d6e92886a636926e9253277f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 100KB
          • SHA256 fa8b34f3eb0cc142a101d7fa6725cd7cef289e9bf2fe344425940cc1b23ee3c7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 103KB
          • SHA256 96ebb3ffb1e1bee65cfeb0515a46f63a29643178dd3173a7f007ec52c437dec1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 100KB
          • SHA256 26e579b4932f2544d081e95c6aac60c4244be874afa756a9fd38fb9540f435dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 97KB
          • SHA256 83a1c5c942ff5fda09d61119dca8f5834142a5b11a5e2cf58666c2c5b9b2650b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 88KB
          • SHA256 69fe60e5739317380f389d68cd52f6fb565c82f7fc3a93e2d375d04ac29f377c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 94KB
          • SHA256 7f966a3cf8b51e94619d69de54c24724695a7fcfb2a8e8e13d831add569b1d94
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 88KB
          • SHA256 b37870b67b76fa8784ad58b551c22c57c16c762da2934b55f3d2f2ca25be0f9f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 86KB
          • SHA256 37003e46d49f9f430b21ea24618a9588e20295a64bdaf39b12a643ef11ed9671
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 94KB
          • SHA256 bedfdcab065af08284458abf941fcd080f0a0dc069c5c496546157b0c34d0a17
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 105KB
          • SHA256 97a04334b19f4f3bf7b2f81a0f31bfd99f929a3f8d13fc9c178708875613cbd9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 81KB
          • SHA256 e7ccb4aa82be429f7247dadbbe69f06a12642d298722a59da811b37d436b3d2b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 105KB
          • SHA256 e4bf16d88417a064306f746d4ed71b9bcc1e9a32cc529dff8b7cd060e49d1c2c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 81KB
          • SHA256 36e031dcbb959c147710b1fde9d9c7d1a4c871a40670a2d35e72026b0524be68
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 94KB
          • SHA256 f5c448d641f086d117b4f5d5e7388724c291d318a28d1e32c85a0d6f79cf05f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 86KB
          • SHA256 a3bec4716dff2be2861d9285414ef99f6b80a0667d5e1f1285c4239da8ae2bc0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 108KB
          • SHA256 91606dc3069d83011454e4b964f4624088b19cc5303155675e0912833058ffa5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/944-284-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/1280-266-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/1776-53-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/1944-210-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2204-65-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2328-162-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2348-174-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2408-29-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2492-41-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2632-102-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2732-114-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2732-98-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2876-89-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/2908-77-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/3284-11-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/3932-126-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4004-257-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4024-186-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4108-222-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4120-234-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4368-138-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4416-7-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4416-30-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4432-150-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4596-302-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4700-246-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4804-293-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4828-198-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4856-275-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4948-12-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4948-5-0x0000000000400000-0x0000000000438000-memory.dmp
          Download

          memory/4948-0-0x0000000000400000-0x0000000000438000-memory.dmp
          Download