Overview

overview

10

Static

static

5

4db95cf63a...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/09/2026, 18:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
  • Size 1.3MB
  • Sample260906-xe7snser5w
  • SHA256 4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
    "C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:3756
    • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
      C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
        C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
          C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
            C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
              C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2536
              • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4308
                • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                  C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2924
                  • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                    C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2056
                    • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                      C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2848
                      • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                        C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1928
                        • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                          C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4884
                          • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                            C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4880
                            • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                              C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:396
                              • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2216
                                • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                  C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2460
                                  • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                    C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4024
                                    • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                      C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3356
                                      • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                        C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4360
                                        • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                          C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4480
                                          • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                            C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:3784
                                            • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                              C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:4656
                                              • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4088
                                                • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                  C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1796
                                                  • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                    C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:720
                                                    • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                      C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1528
                                                      • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                        C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1380
                                                        • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                          C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2432
                                                          • C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                            C:\Users\Admin\AppData\Local\Temp\4db95cf63a5bdd266d98feac2fade63dec3b59aedeb44cf97e36464c546a5bab.exe
                                                            29⤵
                                                              PID:1840
    • C:\Windows\explorer.exe
      Explorer.exe
      1⤵
      • Modifies registry class
      PID:2932
    • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
      "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2524

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Browser Extensions

          1
          T1176

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          6
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\AppData\Local\cftmon.exe
          • Size 1.3MB
          • SHA256 918879212ce29e5ae82eba415fe77fc587a0d56abd5dc355c37db6ef38dc25c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 9b8e205cdd55dab7b939fb83d549574e01d48bcb53b4140c259645d9b636218b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 247952f6ed0f8ed059836a394de060b55eb32c0bfc464db55cca2e3b262a9398
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 10656e671d0dfaa778006b1f0c8bbe724bbaa6b83f421086fd445fb35172c683
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 28e9a2b4cc99b1fa4de545125a56b5229f7ec836b77ae98d6e6f49406f2e9c38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 06fecccd0a3b937152bbdb5698e04cbe43af94ef2a90a694123d1f7df786ed19
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 dc729c6db1b49e9280700354ef399c77ea613b028e46cd7d90a5889ee26ad54d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 a92153302b320411328b3cef27f2feb97e44b09a2bd3c8d402de76f773a912d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 e7ac7b3b4a3cca9525c44d8f86e213dbada0b1a27a2b8359b35011f00f5e4f86
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 72da6a7414ad080bb9a013bf18ff6a1a828922566e1ab6c0f3a916a4973402f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 48bb83914f503128dfb62092ca056db8da99e70541d9a5d6cb24583f29f1fba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 e8214c7eec16da0f5d1b0c455366e4371e7c509ca87b5a1b38232cc1d9831062
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 0ce01c57074a4d2e94b7c56cb661cb917013b8ecf7d181f4042843e3894275a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 727159efd93f0f76586a32d05dd3eab81aaacae4f0701899ce07d3cf301c8f8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 133558e2d2409972864df074f0afef1cc79c3cd0f50c3460a106716d1d59e0b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 daacfd5dff24fc67115f9e6dc559c6da73d193e8691ea41da0f3e9584e138848
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 a077ca1e0289bdf715e6a9c68e79b160ef45e27e9c1d4ea1cbc67c8a125c29cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 c50b129a279feded9c9ce55fb07f480ea1dce800a91112cfa371df91be481c45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 7d22ae523b8671cc90c82f8bebee8951bcb8404ff4e9708f557b5fcc1b9a050a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 72efb3fc4ca01e7826e3595be62168379799ad8c76f21b703b41a39fd01df1f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 1.3MB
          • SHA256 55717cc213c493aa6305df2eef4c7e18bf95cfb6add51f43c8b2e72c197580d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 3fc6264a60b009cde62bffc2432736fdccf344925113f1b9a4d3d2479d295388
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 1ab2b327da28edbce33428765eaac8155a0df4ff712a4dd228af1a301cef52b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 04aa319f9986069e106dcf388cce22bb4baa44083c470e50d1d353e19f65a1b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 134746a4ea394178fed8f64a9d9a923e2047cedfaa329691253a2d04caa4e07f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 7f677df939ca2cae0588ce48f7abb7c48d42d1506738b43801c9c1f09d7bad62
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 3b6e1383ee6c07f8cd0d223c904eb2b6db67eafd5f4c10eb1a6221fc47fb9c06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 36554069475890dc275857df41a5a0155eacdf8f0f945641820841a7cb14e506
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 dacbd1f0790602944af1d0a2117280b9a0eac8791eb0bc3c424ae8a1023728e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 eb0592588cf6237dd4efb50f74f2a6fb6d2156bd6f460a294667f7d3bd6c8882
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 3479ec8716fcdd9249f25c8ebec103497089ccc048336044f3fc54e7b2dfb4df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 10c6378340a68f23323eb572a5b6e09f2f30341fc21fce20bb3ef18474a47179
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 d6a284eda4fabf5686c3bdd9225b702a8f43738a8049d33f144d377ebba25a33
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 39661d54073cb7ad6075946f7638853c9c99bdf4a31dbaaf04c3b484cb2d758b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 258e7a95aa013ec1e8fba0f7c4459b06bab1c206b6e92ab76fbf2972c74bb10b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 09e06f3d54c13cecaab00a8cc66731891980e63cfe3cf2ab8f938ccd2d398bc9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 9adca29ac54648a65673ffe6e2ea453a80bc51be54876078c6d2e07902c60e35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 92b866730ee3645cf13e6ce428aaaf19087d2ab14c7329889863e336e7053d4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 67a36b9d0acf5e2da6b0dd4003a44ce4e653761420428109d4a728d41065ae95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 39ba36cf81d5b6ff45d220a0e001a0bd97251ad5619b74c4a01691ffce4ee9e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 d7e88f118b3e12b4fb5d181105d3c28a24e27f82abf5a4221efa9d37d8ec16a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 1.3MB
          • SHA256 5d72269fc2bda2c784eaf27bc9b1f5d649bfe2b77a921eede072951e1600a013
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/396-175-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/720-303-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1380-322-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1528-313-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1796-294-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1928-138-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2056-112-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2216-188-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2432-331-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2460-201-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2524-13-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2536-75-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2552-37-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2848-125-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2924-99-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3340-0-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3340-9-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3356-227-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3784-266-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4024-214-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4088-285-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4308-87-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4360-240-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4480-253-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4504-62-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4628-49-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4656-276-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4772-25-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4880-163-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4884-151-0x0000000000400000-0x0000000000430000-memory.dmp
          Download