Overview

overview

10

Static

static

10

963a41aa30...f3.exe

windows7-x64

10

963a41aa30...f3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/04/2024, 23:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
  • Size 604KB
  • Sample240413-3l1wlabd66
  • SHA256 963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Detects executables built or packed with MPress PE compressor 64 IoCs
  • UPX dump on OEP (original entry point) 29 IoCs
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 2 TTPs 28 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
    "C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:2616
    • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
      C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
        C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
          C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
            C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2568
            • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
              C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2164
              • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3616
                • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                  C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1980
                  • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                    C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4344
                    • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                      C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4360
                      • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                        C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3212
                        • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                          C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:216
                          • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                            C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Enumerates connected drives
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3208
                            • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                              C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:3612
                              • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3828
                                • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                  C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4996
                                  • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                    C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5112
                                    • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                      C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:4860
                                      • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                        C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:2920
                                        • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                          C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:2224
                                          • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                            C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:3680
                                            • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                              C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2660
                                              • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4236
                                                • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                  C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1528
                                                  • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                    C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4488
                                                    • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                      C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5108
                                                      • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                        C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2068
                                                        • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                          C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2684
                                                          • C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                            C:\Users\Admin\AppData\Local\Temp\963a41aa30f98b473880f76d4cb3f3b727d1e75af60213ecbb66d883246f53f3.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:3692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 605KB
        • SHA256 68a46dadb64b3048b6e2130e15d9d2ebcc3e8f4092fb6fe102ec483a9ee832e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 604KB
        • SHA256 a678ec3dd598956f75a71f44979cf3831ec160839d1037ccfb0e7b3f132c9264
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 631KB
        • SHA256 c665312b5fa22dcb45bd4a936f385370b4f6afb026a1c9e35dbca60b6baa07fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 634KB
        • SHA256 4ddce8b48671d2de67e10bb4a337119876314bfd42071ca82eb213cd18b7f9e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 623KB
        • SHA256 8eff27dba7eb5fe005fa2cc30e0abb43ad69191d857331a0c2b0aed6683ca5d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 612KB
        • SHA256 6c39f95d319b079ebefdec826884a269f944f320b86f4ee32c6a69e7ab109bd0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 616KB
        • SHA256 7f8803dc256a588eacdac451457dc2d5656fda157fa0e621328b9f913c630e45
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 623KB
        • SHA256 3123e402bc17c22744bf50b0d0b4e6723934afc2f817f1ba66f7656de68933bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 624KB
        • SHA256 17b46c4be65cc0e78287a4e782beafae88d771e2881a56414774852e6e5260e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 629KB
        • SHA256 df4a528d1fbfc3018ed2b54f85ca2db018a145b344d7007e4e26c13e7b6dfc9e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 623KB
        • SHA256 a9b895c75e4bdd22ce60f22770cfe8eac1abc9b2cd845603e728415b64507cf3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 604KB
        • SHA256 17f0512e036494675bc79473e56591ecf1a2bb9c2bc6dad974c048eb98dfc432
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 635KB
        • SHA256 30aad622495cdede783934db7e8b2daeec55509cae1c86566ada981be9ca4cd0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 634KB
        • SHA256 9a71936054987a0bb04025e12b79328a60b18201d6d07cee7de263b8d43d0386
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 626KB
        • SHA256 c0bbd13b6e4f5b262f552a7262a2ccf1e466a43efb63b58367c82d3b83e4cb0f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 614KB
        • SHA256 a432c00686bf73bf14d6d6272a30b4411436b3707fdbde620dccfa2daddc4c5e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 632KB
        • SHA256 d984f404b6965d5aa2a6b5f9771332cafa31ce9e84e1e95232130e0744b3f15e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 625KB
        • SHA256 beb3c442e383fd2c30ed47b7d0e6aeff82d302b243ea20529aadfa6ec5da85b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 622KB
        • SHA256 eb835a95305065119734c343c270f590241daf738abb63985d0f3acc55128f59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 618KB
        • SHA256 a348b7e6bff9ca3f69e2c265dd29a94d0fde57d99540f5031008866efcb2c3ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 628KB
        • SHA256 5bdd12d7b77c85555e962415f0e5aeafdd1cecdd0bde571285a331f38d342149
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 626KB
        • SHA256 ecaed7cc216247e6d7d26f673a2dfc2319dac7ff16897c7ff3380cbfab3123a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 613KB
        • SHA256 4ac150a10d9f2524b4cabd8e36ac0f79aaa426b8a8521adea911c6fd53330447
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 627KB
        • SHA256 59e4651679392084d81b2402603a51b9430bb0439df7b8fe36e6c631dd8e6911
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 611KB
        • SHA256 72603cb1768c9581e00de9a90b40831bfd34c29580c3cbea345364abcddec04f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 617KB
        • SHA256 1a204655e7673b99538f9273dce1a5fd75fa69cac0d6c6fb7f910cf73994c68e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 633KB
        • SHA256 d06ef39d8fedfc522622c9117b872fe5f23625ee14dd1294f0a759efc1c357ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 622KB
        • SHA256 c8c7369c7290a9e03c0b29ca9138b9a902919d4013c8cac7d476e2daf617c14e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 9b3e927fb28beed1b426134024e9023ca8e37d753eef9c2609f1ec7f8056e976
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 627KB
        • SHA256 794ebbd3aee0f7f38a49617c658dbb93ad5ca2536ae345ec9f04355e2225e0e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 7d45ede9b3442648d6ba279f899e7f10b348b49a2a2e628ad1498724de01cf6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 622KB
        • SHA256 c42a88d25b88260a232b3b4f18edb83554288d122f7fcc68a50e3ff39f4d407b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 4fe5c04212e92d65d842bc5fcca7958dc020a46a90f83ab21d0136c35c52bf68
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 d818bd54a01aef5d3461440ff7b696c376b5cf62da589d971454b091dd326eb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 609KB
        • SHA256 a8b3cb6c2b001041cfe4e05cb11240314d761492ba9cbb7dcc2a81c261a6aca5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 619KB
        • SHA256 14d89248af504fae3d0bdde2b78777cba08f6e3cbb066d4f4d8675c475876d0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 630KB
        • SHA256 c746ab5552977ccf1b58ed2eafd6032f0914d313ca0fc9e3de9d4c6fdf604997
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 a989c152ff6caa1b7d22171ee4ff4a3afa4790e81c36922b9b9d8d27ba7bb57b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 635KB
        • SHA256 89f5a63ccab1632f40619738a24ef17764463c8c0decd539d5588be280594ceb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 606KB
        • SHA256 2dff10f2baf388ab5a0aa8b49536c0f135db7d5cd21e8b1455a3f3c6fb1090ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 624KB
        • SHA256 01e932e220929e57ab0073bf6a68ae175aa7019fc5c63f26432fb2bb2629ff8c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 624KB
        • SHA256 2936092be7fca5f537288b59d8a04a015d078541b0d7cf61955b257d94f2df70
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 614KB
        • SHA256 acf039581f0adfb37e203ba0c38e89884ceb6aa27d8d28c01f22658fdb75812b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 635KB
        • SHA256 5c8ccb949c9c70fbf67677ad915c237f8d96c496dfbf9706895edfa838b4e9dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/216-141-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/1476-45-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/1528-280-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/1980-91-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2068-307-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2164-69-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2224-237-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2568-55-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2660-261-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2684-317-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2920-225-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3208-153-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3212-129-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3472-33-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3612-165-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3616-81-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3680-249-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3692-316-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3752-9-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3752-0-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/3828-177-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4236-271-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4344-105-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4360-117-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4488-289-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4860-213-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4968-21-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4968-5-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/4996-189-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/5108-298-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/5112-201-0x0000000000400000-0x0000000000438000-memory.dmp
        Download