Overview

overview

10

Static

static

5

11fbca9b1b...98.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/09/2026, 16:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
  • Size 576KB
  • Sample260909-t4ydrayamd
  • SHA256 11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
    "C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:2860
    • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
      C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
        C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
          C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
            C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
              C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3700
              • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4248
                • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                  C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3468
                  • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                    C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1372
                    • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                      C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:996
                      • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                        C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1536
                        • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                          C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3792
                          • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                            C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1900
                            • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                              C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2300
                              • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2096
                                • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                  C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2100
                                  • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                    C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1588
                                    • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                      C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:1216
                                      • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                        C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:1068
                                        • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                          C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:3100
                                          • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                            C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:3976
                                            • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                              C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:4664
                                              • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:3104
                                                • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                  C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1872
                                                  • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                    C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4328
                                                    • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                      C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1088
                                                      • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                        C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2532
                                                        • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2124
                                                          • C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                            C:\Users\Admin\AppData\Local\Temp\11fbca9b1be0949123f7e6c1e380f03f9f6ade21e705d43dad50432e6031d698.exe
                                                            29⤵
                                                              PID:3868
    • C:\Windows\explorer.exe
      Explorer.exe
      1⤵
      • Modifies registry class
      PID:2100
    • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
      "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:520

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Browser Extensions

          1
          T1176

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          6
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\AppData\Local\cftmon.exe
          • Size 595KB
          • SHA256 147b61f827eac13e6c0188a724c3fc2b1873f729167b6af04ac97c34163aecaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 596KB
          • SHA256 0c1ecea79ea4f63c06c86f907b55fb74dad3dca3b0058a0b71b93d5fd0624c93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 576KB
          • SHA256 7ed5aebc23c178d7c933a960720f535d82dd8f1773c5596e4a833b00913c6d71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 606KB
          • SHA256 423f3fc43207160b6b3839de25e9121ed69a5e60b99f2d3a5620bc2830b92ae7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 590KB
          • SHA256 c6dad188176af74e9da81cfe2b66fce6feae6fdb3fb7553d991b61629400be7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 589KB
          • SHA256 58fe446d0658989ef4ba6efffac93642a27b43ab02259f09d7c8b79c84507981
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 599KB
          • SHA256 cf8d54719a3b7572cb5adaa5c301c4f08d52d89318ed7e9c0711af3e70d1553e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 590KB
          • SHA256 f3cd29467b6a90290f99955de45ed8fae4e57451faa4b926cae1a469771502bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 580KB
          • SHA256 15b965a2279190cebf8ad1830eeb8c4bb8d1e4d4f1ec83d538d5a68c91112920
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 594KB
          • SHA256 9edb86088c26474165368025bd6e5c4648c6c49b822880793d3e25afdcc1c079
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 601KB
          • SHA256 e7c905d5fd80c83866d75e130e59e2bdfa1443c6538998266c54fa6009348999
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 587KB
          • SHA256 55d33786f341407b7bd7bea4d55e05885c1057dbb635600724035078c240af28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 602KB
          • SHA256 70c808627157244621be7403f30c1a4e64251f7de3fbc297337560751d09bbbb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 579KB
          • SHA256 13c0a08572eef2ef22f0bd5f8f5ab4c955437206d69113f163f95a288c8cd8f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 584KB
          • SHA256 34ec8cbbe7ba3e171b886656d046f7bacc4b46fc61789b60edcd81cc401c1d93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 579KB
          • SHA256 db88afe4e03fb063a5f53985b1bea4f2ce528cc3d23125b91d790d2c43a63539
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 583KB
          • SHA256 566c1e2545ed1a5952e05dce99c82fb60ff16a84b715d52768689c09acd98ca0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 593KB
          • SHA256 adb7286a6ec8d4e0a06b3d25751f0fa2eb53643bed56479b3b7efb3bcfb46a71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 589KB
          • SHA256 cc89acc72efa65d1d1fec72af6f38113d6990070013fc79fd980aececdde896f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 596KB
          • SHA256 5680fe169eac1a5105b8eace9317e3a6350f4aab1bfbe45b391f9eccbff9968f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 599KB
          • SHA256 c597ee8d66e8b4b3f819f693c16faae5ca729fa4e83b1636975fbfce86f174e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 606KB
          • SHA256 cdc3c10808661eac9ece384f169155a46d1de5d07d819a7bff96be2ad6a1e384
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 582KB
          • SHA256 878300c7f32892df8d64995db7d443c4875f5b7e950d105cde9965e97a824140
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 606KB
          • SHA256 9685f4f236462226405616b881ea8e50b8c6c152af03fdb652d4bc5c06b936b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 601KB
          • SHA256 95fa50f397a65eb0410e6ed559b3afc3927684d69b03b7bad318cae279993897
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 590KB
          • SHA256 c55ff82a91c7cb53e059cb0475ceb9b9a356cc103fe5e7153cd3e0b8bcf37e90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 585KB
          • SHA256 048b0de9c26000b5e5aaf2e4656d4d33c8247de7c0a34a72679d4f676d8f4a82
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 579KB
          • SHA256 2ebb7fd9f8482933f115aa64ec9aa69dfce9c7755c7336ec141fd53e2def783c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 593KB
          • SHA256 c079011632206b21b9038b9f12541a55915ad8ffcbb06291f110ea0ac1131752
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 601KB
          • SHA256 2fae21d58c0e4508b2cc3e6cb1f81a99f48d848e1a3420b98280caaf26a8aea5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 600KB
          • SHA256 f33c7eccc1393c78c63f6897f9cc2cf4545534a483377c3cf78bc35e15bccee3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 579KB
          • SHA256 b6ee2fef09c1a30edbdc6f0f54e541ea7dd696937ed50f00735ff25c2096cfde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 593KB
          • SHA256 9106129421435ad3f9f94c4c8f7e309bf32d7426f40646670cfb49766b67a500
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 587KB
          • SHA256 378e6e4fb164c42b6e21ae04cb7b27c66d5987295f9bdae1934e2e2889fa60ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 585KB
          • SHA256 03eb3d6c44a23637a5bf83d826770938d1b3ac08d1d2ab9dedce8907df4e280d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 595KB
          • SHA256 ce5e3fbcbce19712cd7a9008c1f34d651fc73ad9700b6a54c0299dadfdd086d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 603KB
          • SHA256 dfcfa6be8fe833fd087c2262984b70b4a886186ed20615f251c411c4f9b491e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 606KB
          • SHA256 ca3d369aebbf52a29e49417526fc918d131a5ce0b5b295a488d972ba6c1f9f9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 595KB
          • SHA256 ae9d24b5693755dcd0b6a49996ae8fc0c4b54763e2f9b04909b02356c5654121
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 577KB
          • SHA256 9383580bce53290d64f6603822cc6208f35639e031e9b96fe68fbdd7d08a15c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 582KB
          • SHA256 455ff5fd54f7fdcf3e0f0061b55c27df9b7230559b26fd8fe92bfd55ba0e2f2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 598KB
          • SHA256 a60ebb7bf56296b02e95e2ac622428fe7caf49b4dde1239d88c2f22dcf6cd880
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 585KB
          • SHA256 f668af8e177c049cac2668960347e49e57e5004d066898a14d31e5546cce2a40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ftp33.dll
          • Path C:\Windows\SysWOW64\ftp33.dll
          • Size 5KB
          • SHA256 708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/520-8-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/520-18-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/996-131-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1068-240-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1088-314-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1216-228-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1372-118-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1392-44-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1496-69-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1536-144-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1588-216-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1872-296-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1900-168-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2076-57-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2096-193-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2100-205-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2124-332-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2172-14-0x0000000010000000-0x000000001010B000-memory.dmp
          Download

          memory/2172-0-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2172-21-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2172-22-0x0000000010000000-0x000000001010B000-memory.dmp
          Download

          memory/2300-180-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2532-323-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3100-253-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3104-287-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3468-106-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3700-82-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3792-156-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3976-266-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4248-94-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4328-305-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4664-278-0x0000000000400000-0x0000000000430000-memory.dmp
          Download