Overview

overview

10

Static

static

5

43a9cfbc5c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 15:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
  • Size 708KB
  • Sample260910-s3v2katygs
  • SHA256 43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
    "C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:3568
    • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
      C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
        C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:372
        • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
          C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
            C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2240
            • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
              C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1136
              • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5100
                • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                  C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4820
                  • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                    C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3036
                    • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                      C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:5116
                      • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                        C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1132
                        • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                          C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:740
                          • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                            C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2268
                            • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                              C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:3796
                              • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4708
                                • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                  C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:5092
                                  • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                    C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3124
                                    • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                      C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:4500
                                      • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                        C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3512
                                        • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                          C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:3276
                                          • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                            C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:864
                                            • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                              C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:1624
                                              • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:1844
                                                • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                  C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3508
                                                  • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                    C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2440
                                                    • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                      C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3152
                                                      • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                        C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2356
                                                        • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                          C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2000
                                                          • C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                            C:\Users\Admin\AppData\Local\Temp\43a9cfbc5c1497f48e61ca40f5086a640bc2bc8f1c79ef38ebb01be90d705c18.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:3448
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:3728
  • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
    "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4020

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Browser Extensions

        1
        T1176

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\AppData\Local\cftmon.exe
        • Size 733KB
        • SHA256 11f26d4d4dd693f72db8acd7f9d964b277f78c666d4a8db180b30cb3ed7b380b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 734KB
        • SHA256 94b580323ca9119aa0721b56a083abf760e4e3dd800341e5695f8c7a1bfd5430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 725KB
        • SHA256 b77bd29e731a9d843a35a82d92789ead27af301e70f715ced65fd7025a215c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 719KB
        • SHA256 d3e3030cff090c0a2e9963c877ea947bc6340cc64b7022fe47f265232fa72277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 712KB
        • SHA256 14c6c67076e3fc8bf068e7bf66c43bce38a055e58c670947f7b020565b5e63f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 727KB
        • SHA256 8efa811fbf79344826ee1660536c271144834c33294710bbb0df2896b18ebedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 712KB
        • SHA256 8c4affbd3457f3eb49de94d48ed1217c7f22f6d526a8b765ba43097bf0d3283f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 730KB
        • SHA256 2b3e6ddb09869a888858db12f077aad7f4ba5a289e5ed392a96d56ee090d534e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 732KB
        • SHA256 21bb53cda1641486009b4ccf73af1b5c44c9fd227bc0418f8f75fd95c9e6c721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 711KB
        • SHA256 cace742606dda2cb7e4f81d523989b26fa74682a2f23a38d358ef051843a781f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 738KB
        • SHA256 f4621496f68976148ea9f65dfab7eeb37137dbc39ee972db7172e8b6a0415374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 718KB
        • SHA256 7c5e966d472a68a3120e6463035e11528107a603ace5bdf3e61d42fbd811b8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 715KB
        • SHA256 e35a1b4bab203472df59fac64c0370c54805145cfe1b546934c0a0e109ecb015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 710KB
        • SHA256 6383e008cf4f70e156f0a1116c511820c4e1d98de17fca00840c4bdc3376d604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 731KB
        • SHA256 271f1c043c017d551c764fc6500d10757c56ddb8e58a99919cdd36c2f7ec3776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 736KB
        • SHA256 a1d4cdefb11ff21828eb10a31e6df66219fa55d2de6bc328ca87c6942d6e46d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 730KB
        • SHA256 a65fdfff946aedb43e1637fd33514e80fd72f5c5e00147f2ba1751812aa488c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 718KB
        • SHA256 7a30fde9f27db1ca26205c34dd42b94a27a0d9011af61ae0358b7d6048f76a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 734KB
        • SHA256 06b5480df558e11dcba332821b3a5e3d6456e7f76efacbe31aaf2d64089acd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 739KB
        • SHA256 35db1d65282d4628886571212fbf02eacecfcad436f43323765a3c199cc202ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 740KB
        • SHA256 ccf206120feffb046b8f4715d84e844a9246a1777a20e30c20ddb1cbebf7be1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 712KB
        • SHA256 20f11c2cc7d8853452e41fdbdcbdc83aa1c7737ea7b7ce1ebb5402538000e992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 715KB
        • SHA256 4fe70461975b5d88cc87ee29714c91688be726f184b09db2dc23c995c3b84780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 709KB
        • SHA256 ffd0360aa7031243acfb6ee8f47a7ffd60cbcb5691dbc90e7019801d52db750f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 736KB
        • SHA256 3c4a432f0dde2a37a75a1201cdef0b28656d213a956f283e0313fefeacabf2c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 731KB
        • SHA256 ddb22418854d8f012c85a4ef22037fc4669fdc5d16cc0222fa6daf85fae70c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 720KB
        • SHA256 ec46c495d6459d8c988051b31454e87edd1dab4ccd3f00fb861bb85690d28a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 718KB
        • SHA256 5efea433cc5f9d4fb7b2afe12c458ec12829e9d07c06bddf1cf4bb10159739f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 728KB
        • SHA256 642dbe646f14288721dabafc538d5c5263069d56adb85f194e2f0223b667d3e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 723KB
        • SHA256 917099806d0ff1698c93adda28c3c94c2c00539ff9e0745c2f4bdb2d72009453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 712KB
        • SHA256 0ff5f7a5e156994c775476854b1b444ad44db36b2363148b1002fb83cd9ed286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 727KB
        • SHA256 9c41dc6f5345234b6694e2cbf28199706318dd64cd9217661cdbcba59e122e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 728KB
        • SHA256 d5269fab5d0ff7b4315dded1d00e34db87667d1758fc34f010f3de38c664e76c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 728KB
        • SHA256 172dd08c401fde9fff7f35bde09d01fa337f9f65fe2ff136f3039d35a4d059ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 726KB
        • SHA256 0bd505f9261600886b74566a822f71701b83e3892addf2e39bb4dd601f207bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 728KB
        • SHA256 ec0bc1f4b125fb229a64a0627602aa72aea0bf32db8e2f303e2d84a3cdc1615b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 739KB
        • SHA256 280f0a0dcb01df94a72d38ab479d09bb0aa3f8df6ced38b82ddcdb6838651723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 734KB
        • SHA256 d6c497e03039245562530838cbdb17b49a19321948c28858e9ff434632a3db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 731KB
        • SHA256 1d7189cf166d596a2c50acc4cc4112ae76086a8f026958818dd5632cb7e213dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 731KB
        • SHA256 36f75f34a859ce094337930057c80e485d58d3cf07a51ed8f0eb486b63414e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 736KB
        • SHA256 cb3e0cfd3d8478b4b52985403c96ef33ad45217dc752f737cd3b77afa3180cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 725KB
        • SHA256 2d152ef1a6778928921dc9c7845f5f2752851d97c41f1513829c5e28714f15ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 728KB
        • SHA256 1edbb3b15e17bf9bcbbd533f9f4266cdf6476cc54fd4e2ff24b3d33bc53cefde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/372-37-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/740-149-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/864-259-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1132-136-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1136-76-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1624-270-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1844-280-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2000-327-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2240-63-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2268-161-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2356-318-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2440-300-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2600-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2600-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3036-112-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3124-210-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3152-309-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3152-298-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3276-246-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3508-289-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3512-234-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3796-174-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4020-14-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4020-12-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4128-25-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4500-222-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4708-185-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4820-100-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5012-50-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5092-198-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5100-88-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5116-124-0x0000000000400000-0x0000000000430000-memory.dmp
        Download