Overview

overview

10

Static

static

5

4a6205edf5...c2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
  • Size 934KB
  • Sample260910-vbgqzaserd
  • SHA256 4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
    "C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
      C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5892
      • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
        C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:6016
        • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
          C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
            C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:8
            • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
              C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4276
              • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5136
                • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                  C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:6020
                  • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                    C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3108
                    • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                      C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2908
                      • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                        C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6108
                        • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                          C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:5616
                          • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                            C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4456
                            • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                              C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:5848
                              • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1920
                                • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                  C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:3724
                                  • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                    C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4436
                                    • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                      C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:824
                                      • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                        C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:2392
                                        • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                          C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:5936
                                          • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                            C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1100
                                            • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                              C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:2732
                                              • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:3880
                                                • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                  C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3584
                                                  • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                    C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6092
                                                    • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                      C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1368
                                                      • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                        C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4408
                                                        • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                          C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1032
                                                          • C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                            C:\Users\Admin\AppData\Local\Temp\4a6205edf5dd8e8933a30bd82791eafa88a9bf0d3eb2693badf2215cde8fbac2.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:5536
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:560
  • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
    "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5500

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Browser Extensions

        1
        T1176

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 948KB
        • SHA256 0bb27a4a19ed45405ba268790051c5df94c59edce0c04a27a6d4ea7d1804f159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 946KB
        • SHA256 fa9f369293cb39c757c84c6c7b82ced72ee57e1b1444449bf0a0e59a0a7765ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 958KB
        • SHA256 fb81c83761a7063da74e26764e0566f54080781c42fb067586af67733e34390e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 953KB
        • SHA256 b6265dbf2f53c5fb69d09e02bb4e22582d9dace3485b8f8a046264f25549cef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 939KB
        • SHA256 033cf7848a739ba71839e752367e0db6cac404ede37628b371c01c11480a0dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 936KB
        • SHA256 e338e00fd6cb2356c329339d8b632e2737f1af0847405caf4231022fbc5615fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 947KB
        • SHA256 1329db445cf51d1b409eeeccf900aa712ebc3068295dfb18b47cb3ce7ee1505c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 959KB
        • SHA256 ef4cbe749e98211f43cb86b4ec913458b03c22bc5a257efe588a12b93845fc75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 954KB
        • SHA256 d88c2ddb9b117bc4116315a699ad63820e779d86322640c7f20e22d9c6f5cdc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 942KB
        • SHA256 c91e9cba421af0ea8762d3e7924f37c0c16a279c1df1a01c444749b39876812f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 960KB
        • SHA256 79f21ab21ce11645ebc897e8bf55f364349c59518aec56c099dec87dcf15f015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 948KB
        • SHA256 48301f1af14057f53d18af1b829409d4ac2258c6c566316297b8fd4f0495db0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 935KB
        • SHA256 b4e6f1e33a8ade0b61e02f50c98a69f636c39ef8ca0a84bbd6f499b9a5c04d74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 951KB
        • SHA256 700c9c3d42bddf013f8556e8a4f7d5f4e223d6613f76971d7a16c640b9c72fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 949KB
        • SHA256 bd102a970829815bcddb23c17a36ac5b44156d3e5240d807322abe594cb512f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 966KB
        • SHA256 220e023cc275a92b71b86d31b6b381bc45e12569c32a7c2d9e2874c5c90a737f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 958KB
        • SHA256 bfd6c5ec7da8687b834c2bf9e7d083c83cbf3c081239e6ad343e33c61bcf962d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 964KB
        • SHA256 ecf43bff708de1498f31816da3cbf254c90d871ea383db954f21c882ed7fa2d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 946KB
        • SHA256 e83d17ddd972ba0ed372f40eb182f01d728429cb0b714d3d3ea9f7394c12847f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 947KB
        • SHA256 5f371ecacf2376ee767e20590958d0cec5dd9a33e09e38ccebe5fdbeb581a27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 939KB
        • SHA256 99d86894057fcbea4871d0082013d2cad6f9341c4abd1ebd88f9b8025a1e5953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 962KB
        • SHA256 a0aaafdf24ac5494932d5c380a46f69565ac16c656d29b06cf891d2d69a4618d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 952KB
        • SHA256 5b4e039d2cc5bd53a9a3dbb19d729e6b7ee98e4ef400f3e9c5b8d01860b204ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 965KB
        • SHA256 82ae55548cd9de6872afbdffd03fae685e25b45a3ebc96c676860d5c5464b20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 960KB
        • SHA256 68c47df6452c181cb42ea074eac185d6f76a753a6aa80e02784d221e3a388bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 952KB
        • SHA256 60616599a21fa350019d95354a6c59232544826a6f1554e25a8dc5293c83145c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 957KB
        • SHA256 387219738a55886a7fe87c32c1e81794c76dffcce38cc9c5790fbbd8d50e9e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 960KB
        • SHA256 7201f8ad543063fb98d6e7f4cfce24d011438daa65f59236c7b4ace047c1ad81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 938KB
        • SHA256 144708a1dcb93ae46493c36ec52f6519c6f6986b355e67a60cecbd1065f2d599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 938KB
        • SHA256 99b1db9de9a8d99db4dd85ace9c26a95c702ffa3b5ac0d9d2bae62c83103e6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 936KB
        • SHA256 16a9627281039af069e188f21fd4a17fb09295487c2b5521be108272545f48a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 949KB
        • SHA256 0e36126e754b9681c6464a875d9a41fb14475386cc5a8265bc8a83ba1e357ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 949KB
        • SHA256 f981d9245b4a55a94d5c04002e9949ad7b0c5bed4630e93221f3d05ea2790db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 944KB
        • SHA256 1d32fd986baef1c445e8c8ad934cacfb2d0e437fd15bf3033e6320ff38283460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 965KB
        • SHA256 ce5787512707837f8d860078f49e56c65f8a0ba1154265a03b459e0c6c14595e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 954KB
        • SHA256 40ccb6500c218ca6c0e37fc91f47ec112902d6cf279b334b9899637703002bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 944KB
        • SHA256 3b6457728c25f20c73ad67d22bf175eea1b94db9a0c1d0ebcd238633dd768135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 936KB
        • SHA256 21468b6faa46f3d900db92d0184560a1cf5ad1529975426772b054bd6223c4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 938KB
        • SHA256 87caa74888b32aad106d11e2249beb9ce77295aa68e10fc4d86132d57b5a9a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 960KB
        • SHA256 f35e76efdd29245be917d81d497b2c68a2b63f92003dcaa57962119ad4ac280c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 941KB
        • SHA256 b06b3e7d1cb74c2f092ec59af2881b3370e8e97619690d5b6ac09e5e84c5f0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 941KB
        • SHA256 9fed1a728e75b3a07e7146c4f4d903347fcdab2350738adc833b72b65775f820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/8-63-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/824-227-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1032-329-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1100-265-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1368-311-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1776-50-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1920-191-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2392-239-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2732-275-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2908-126-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3108-113-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3584-293-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3724-203-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3880-284-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4276-76-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4408-320-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4436-215-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4456-165-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4772-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4772-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5136-89-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5500-13-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5616-152-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5848-178-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5892-25-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5936-252-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/6016-37-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/6020-102-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/6092-302-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/6108-139-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/6108-124-0x0000000000400000-0x0000000000430000-memory.dmp
        Download