Overview

overview

10

Static

static

7

92e6a98bd5...AS.exe

windows7-x64

10

92e6a98bd5...AS.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 13:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
  • Size 520KB
  • Sample240507-qbppcsbe43
  • SHA256 082cc5d303828342acf95ad04ce198ada1d81cac937df819abced2bfbe23c88c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 2 TTPs 28 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:3288
    • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
      C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
        C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
          C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
            C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2316
            • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
              C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4044
              • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3596
                • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                  C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2564
                  • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                    C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2320
                    • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                      C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1576
                      • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                        C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3552
                        • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                          C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2372
                          • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                            C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4456
                            • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                              C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:4056
                              • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1352
                                • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                  C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:1116
                                  • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                    C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Enumerates connected drives
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1148
                                    • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                      C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2548
                                      • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                        C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:1824
                                        • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                          C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:2912
                                          • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                            C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Enumerates connected drives
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:4488
                                            • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                              C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4380
                                              • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1296
                                                • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                  C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:892
                                                  • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                    C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2204
                                                    • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                      C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1036
                                                      • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                        C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5056
                                                        • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                          C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1452
                                                          • C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                            C:\Users\Admin\AppData\Local\Temp\92e6a98bd59a1f30f1eb5d23d192f410_NEAS.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:3380

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 523KB
        • SHA256 2074c83d37889760f6b2b9e73f15aacfb6e2bbac22ad46d8ed682e3db6f18824
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 533KB
        • SHA256 538755681927378f030b91a99ca55895e15bdfd89d997ae8580a002458a636ec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 529KB
        • SHA256 517ed1861c7aba8934aeec1bb0d55c2af9beb6aca7d8b65074db692d3b9f376a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 538KB
        • SHA256 773eb669086d9ba3370a3f6346b7fd9ea5425c46c85861ea903dfea6bb2f191a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 540KB
        • SHA256 48c1766a496638ad5cf8394e56557f9908a1e575a081b9dee720f2bfccb226d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 527KB
        • SHA256 8b59fef05fc5292cb074eb4316648bb6da7fda7052ac12c56ee9752811074225
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 523KB
        • SHA256 990cc82061bc7cfecec6350320606bde1df7992e48a7e521062264347a8059e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 541KB
        • SHA256 5aba8f10f3ebb2ed36404faa0941a0ed2de4ad12b76a656b456c963d5fbcdac9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 527KB
        • SHA256 d0a1593407a788b596a8685410e6fb1538a876655b41f8d72a4cf914ce3a290a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 546KB
        • SHA256 2e048f472b967eb1435ad1b874bf9027b05a51c56be2d094056ae18f0e7dde09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 532KB
        • SHA256 abfebffe78e58cef9982338768aea6d7b3195aeab76e5ee7da5157cf01876889
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 545KB
        • SHA256 8b32f011582ada7f0ea83d493972f4365d37ab0cbd25097ef17ccdfd0ed44e64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 521KB
        • SHA256 c13c844a114e07035ecb7598df75638cc7524ca4278548b86790dbc4b25ddb84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 535KB
        • SHA256 f9369b47465222c14d13e895ebb89ba52a1d510559bbdd5af3c5ff2aaf4a4b34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 534KB
        • SHA256 ed2430d45c8b71c05f1566f80403001086ff158cfb9ab98233cb2e0ea6935235
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 538KB
        • SHA256 a7539a794977c4cc4e2081440417996d85c85fe1172d86df0d61b59ab59f008c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 540KB
        • SHA256 1a599820dd0946e21a5be431a3e01b1010c7ab8344c7c85f5c3d774584b1faaf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 548KB
        • SHA256 3fda2825d7d74b16d9e82cb6f2b206ade35a8ff69393e3e512502a3ff8004287
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 548KB
        • SHA256 90f8e18a78485a63de6bfcdcdc14b99f4243709d4e79ade1a54e20d749770a39
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 536KB
        • SHA256 debf032057f61bc8cd609770ecd5ef6929b24194da257fd093cae1f0ee1596bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 526KB
        • SHA256 c1ec5ecf4c2ec09012300ec8a8ac97b5d3ac4a065eab3bafcaf07ac360f59c21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 520KB
        • SHA256 d65c94e8f9c9603d447fd1a675598ae909d55f5286291dc51b3712767dadcb4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 549KB
        • SHA256 15b729bb94522e6149da17d3baa5296d3deeccce76c20db7adfa7d3e7acdf3d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 525KB
        • SHA256 f2ff39eb5e96fbb0011fb98e7b57d66c7bec4c1f245770a039fec03248dd0ed6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 549KB
        • SHA256 ba0a1f4cec1ec89b7bc3d042b8733827264ccf71196dec25d808880a23f39106
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 525KB
        • SHA256 6ec0ba387119839e8626a8ef85be468e1c5bb3bbf670a9ddf83957d74b42edab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 540KB
        • SHA256 6b7924d108843c97475efb0e7a83fecead9aa6eede6d8fbc8181a44f3a30c5c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 524KB
        • SHA256 c23d5f5fededc6f4f4aafce35a1b44fa8759b46238653a776da3d7645e732017
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 533KB
        • SHA256 1b5cb9f33aa9ada34cf1c3de4d82660b166d4df2a1457289c8f6196747de6ed7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 541KB
        • SHA256 fe5b19fd5de6a4c8a932aae1a547e123c3eae07d63bfac249d5189ff04432d86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 551KB
        • SHA256 1d29a6d519fa56c176b727393605757afd2b5c7cd6a1d139d5d78ed36ebf1a98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 530KB
        • SHA256 803384d27cae014e4f0a441a0fab14ee003c3633b5a08940620aeea0e05c34bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 530KB
        • SHA256 a02ec58820c6345a40dce1e08501d3f4ca28159e3f31074da4e86366aa95c49d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 548KB
        • SHA256 32528810cb9ba790d9234e2ae3968923051402dc0eb4bc059238d89411e1c77f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 551KB
        • SHA256 185761ea8329f2d84f890de9c389dfa5e38cfa3a32036b05bd561695319d0fd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 551KB
        • SHA256 3d38c3946202ffdbd2762230ea38e7096d175a81fc944737311110c9de8f95a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 522KB
        • SHA256 237a4849224bc55c6f6b6e9bc8884542e5e42d9c38825dab7868ddbeb15d0602
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 524KB
        • SHA256 5c7418dba82ff5ad99fdf7718a1b7a8777ae93a25764f4b73baaf39360438aea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 527KB
        • SHA256 50df46cc37dbf227fcc4f8c22c9c97e6fc88190a884fc2c10a993ddcab37196c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 538KB
        • SHA256 8ca79eaa80734143f4735f22750ac512f16bf57f6aa1a9963c645a6da566fe33
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 538KB
        • SHA256 41974f872979faeb6f2555ae508378e0b8faca470fd18ba9fda85e9efbf8c574
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 540KB
        • SHA256 4e557f16e2372aa501d2403d56652883fb7299fb0f1239439aa0664a05746e13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 545KB
        • SHA256 2d8dd7ef0c3e80412aaf9f97235870a4d100474574c97211b72e981ff3b9468f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/892-301-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/892-290-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1036-310-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1036-321-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1116-206-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1148-218-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1148-204-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1296-291-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1296-280-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1352-193-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1352-181-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1436-22-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1436-7-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1452-330-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1452-341-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1576-114-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1576-129-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1824-228-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1824-243-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2204-300-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2204-311-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2316-62-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2316-47-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2320-115-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2320-98-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2372-140-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2372-154-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2548-231-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2564-102-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2564-87-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2912-256-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3380-340-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3552-126-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3552-142-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3596-89-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3596-71-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4044-75-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4044-60-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4056-165-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4056-180-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4212-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4212-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4380-281-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4380-267-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4456-168-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4488-254-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4488-269-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4812-36-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4812-20-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5056-320-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5056-331-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5088-33-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5088-49-0x0000000000400000-0x0000000000430000-memory.dmp
        Download