Overview

overview

10

Static

static

5

244c4b3474...1e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 09:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
  • Size 582KB
  • Sample260910-ltjtlsgd77
  • SHA256 244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
    "C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:1644
    • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
      C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
        C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
          C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:736
          • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
            C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3184
            • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
              C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1396
              • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                  C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4448
                  • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                    C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4120
                    • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                      C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1164
                      • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                        C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2424
                        • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                          C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:1868
                          • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                            C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4040
                            • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                              C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1988
                              • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2712
                                • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                  C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2524
                                  • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                    C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:436
                                    • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                      C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2884
                                      • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                        C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4904
                                        • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                          C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4704
                                          • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                            C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:2800
                                            • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                              C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:3444
                                              • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:1128
                                                • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                  C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:696
                                                  • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                    C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4648
                                                    • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                      C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4348
                                                      • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                        C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1200
                                                        • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                          C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3664
                                                          • C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                            C:\Users\Admin\AppData\Local\Temp\244c4b3474956ff1d7106d2dd16552d733e6e06702d0830a8fe9e2c224b7971e.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:2968
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:4516
  • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
    "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4564

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Browser Extensions

        1
        T1176

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 587KB
        • SHA256 5f5091224974852c6b35ee3049a5762881fc9c339503fa1acd3855e9f49dc106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 591KB
        • SHA256 550c4b076fc04450d7f0a3c7558af39ba08435e444e13dcc70e0af5bc5cf90db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 595KB
        • SHA256 42ff9386cf0fa154a360c4828f22e42fa2b92faec6a9918abf4928a0a3abbfab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 585KB
        • SHA256 842272239f4a9237ce9e7e5e19a1a3814103408a240de1c7aab33e93093bbc9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 591KB
        • SHA256 e0877cc7375d93fb5f6052b8c1d2b0ece29ea68efacc82dbb0e65ce5393845ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 587KB
        • SHA256 c230f61175d0fcb632eb5ae6b06d783fd4bd53b35a4597686400d53475093df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 599KB
        • SHA256 6749072c76b3b894f14c70b5831ce6125a1256f0fb0de4cc566d205a8c109cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 603KB
        • SHA256 cf540fb029ba5f2b6e147050abd9e0702def75ddcd47f7d8dafb53a1ffa926a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 587KB
        • SHA256 ad5577642679f78f05b421f8c019dee82b7e9b714198071c9bf3de4a83b17367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 599KB
        • SHA256 c978659037814ec173db832a7a3473eb3a36b3a4bd40eef07763f276a578e7ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 595KB
        • SHA256 37a979f633ccfff39322bd7fd81d07edb084c04200678b84de245f863ca3e25b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 612KB
        • SHA256 c9714a59ddda62f0b55f12d8c06f1e9e70332e6a5003b26e865156b06a709673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 598KB
        • SHA256 e9f60ae0aabe73793e18080395bbfb02576b67e5de8a28eb23e877f049dfa637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 606KB
        • SHA256 20ac9b719bf694fa5e7a1c6332d83d96a127a14be7b58350d1e1a73ac8ec4a53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 601KB
        • SHA256 15b4d9ef9f3fafef487ff2457b16fd7304aa9162034dede591b9a4031a0798fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 585KB
        • SHA256 3a5f898e6e1b2695b298ddaf29cc7924cbe660889e90d6783ec3c96c38bb7e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 612KB
        • SHA256 076a8350abf169d28eee13782eba5ce0201f0088f789547dd58f78a5205398e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 600KB
        • SHA256 9c4837fc0a0b583f9715545d384b9473f858017575e3cf346d68720d7a3a3f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 589KB
        • SHA256 e10f509d9a4ef6a71193e4e0383bd1164e5f43146332869d55c11c1ecb3f284e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 593KB
        • SHA256 8c1e6d8d26436f6e078f2b2e0141593eae91a6957760e590fdfc4ee93826b947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 613KB
        • SHA256 2c8c5305798c0e361ae73edf1f132dad83a31b75e55cdde330188939cc32bd1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 583KB
        • SHA256 3cdb6fe09b4fd5627791ac2de9d9be169ee1b43e9c16f6a1f489c5cffdcec55d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 604KB
        • SHA256 24c0831289669d491e520fcf36f91bfdc665694e4dc528a1c39f0599f71dd05a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 587KB
        • SHA256 bb2517d1f9cf447e4ea9a8c2bc82c2d4aeeee07a4a5b55369534cc3b1f7f9f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 591KB
        • SHA256 a75912aa030f46fef85135133d4085fff07758bc0fb8cf98e09f6bb76ff460e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 594KB
        • SHA256 937fafebb53ad5de7ba7f70b105fef138fda1d7f478c4dbfd6e5d7492b9a7afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 596KB
        • SHA256 2f86a9ca30c86319f6c2c2b1d12d3afa5cc6ba131f81fd71773e819d460939ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 594KB
        • SHA256 b59ff69146e2e93fcdf4b2ed7fa00781c942d11eb19f10104a980f351c655094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 586KB
        • SHA256 b46e0c1f6c5810c2d0564efaabbe0610eda7f6252087238bf9f7459df3f015cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 599KB
        • SHA256 d70a2f145a0f0016afb9cc5af50548db950724d3a12830ac453ae1b848dc1b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 583KB
        • SHA256 9cce4a929f354c368bebf6fcf1ea739a171395d521eab10bfc1f2381f72677e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 607KB
        • SHA256 a80de3050f4bbeaf88f30fd68aaa2bbca546300d25aad836415663c42539246a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 596KB
        • SHA256 50da60de8bcf486e9a95496207659a355a4ddc288c16aa7303b7d2e0e644bbda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 588KB
        • SHA256 c3b7a8df790bafe667e5b1374481b0a8548dc7cac4d10f57045ddc2d4038b0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 607KB
        • SHA256 98d951a5cc447e6f471b53aa983bdc26fc923f1b7b1cf5fe02a78f826058ad0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 593KB
        • SHA256 c2d48e5dd3d90c50056c56c1acd59670586cd3384ceeb5d095c7ed8a5785473b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 594KB
        • SHA256 dd864ebd821adf32435abe7742f9e591ddf324100b62121d4c35f65805de73aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 602KB
        • SHA256 97b819e23a6819cbc4cd02c078cb13fbf5f71a34489ef5f00abc9ddb6fc66e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 588KB
        • SHA256 a6fcee3c05de07b0017d1575d2c893d36d20262e9c1c9ccc215faabd60d3acd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 596KB
        • SHA256 12716c6857b90254eb3e1f3fedd43818789a2a76ba742561e027c30bfbceff42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 604KB
        • SHA256 3a58d6ea73a6e73d98beec471fce549c55ad01c27f508701bb0228b8ffbd45ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 612KB
        • SHA256 084b25590c5aa495ba1e1ec28ca26a52432438777e7077ff6006edf247e99c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 596KB
        • SHA256 816c96381d8d1eb1a9ad46ba396501c2933f75131d92b12f12c90dc483058dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 607KB
        • SHA256 5f4171654230204016732b17dc698a7209e80caa2fe3409897a7fdcddb410fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/436-210-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/636-38-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/636-23-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/696-290-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/736-50-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1028-87-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1128-281-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1164-125-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1200-318-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1396-75-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1672-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1672-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1868-148-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1988-174-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2424-136-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2524-197-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2712-187-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2800-260-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2884-222-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3184-62-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3444-271-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3664-327-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3980-26-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4040-161-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4120-112-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4348-308-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4448-100-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4564-12-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4648-299-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4704-247-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4904-234-0x0000000000400000-0x0000000000430000-memory.dmp
        Download