Overview

overview

10

Static

static

5

5351192bd5...fb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
  • Size 587KB
  • Sample260910-w151jafk3z
  • SHA256 5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
    "C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:3792
    • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
      C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
        C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
          C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
            C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
              C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4996
              • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2540
                • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                  C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3280
                  • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                    C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4764
                    • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                      C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4864
                      • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                        C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3368
                        • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                          C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4948
                          • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                            C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1084
                            • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                              C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:556
                              • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1216
                                • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                  C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2680
                                  • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                    C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3384
                                    • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                      C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2456
                                      • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                        C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:1720
                                        • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                          C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4380
                                          • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                            C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:2924
                                            • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                              C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:696
                                              • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4372
                                                • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                  C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1916
                                                  • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                    C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5032
                                                    • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                      C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4656
                                                      • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                        C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4848
                                                        • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                          C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2336
                                                          • C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                            C:\Users\Admin\AppData\Local\Temp\5351192bd59b7b185f076a7b13a3b8b66c07cab5756f2e89723b215c3b0080fb.exe
                                                            29⤵
                                                              PID:3248
    • C:\Windows\explorer.exe
      Explorer.exe
      1⤵
      • Modifies registry class
      PID:1188
    • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
      "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4792

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Browser Extensions

          1
          T1176

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          6
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\AppData\Local\cftmon.exe
          • Size 593KB
          • SHA256 a730247ddb500170bf85f0255f11eac3ce50ee54a20773e4186de541e3c0c877
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 608KB
          • SHA256 748d9efa6e4d1cbfaf3b7106ada55a7d7fefd52cb23c1e246b0025a14b3f1b7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 599KB
          • SHA256 e62bf2e8a6610b9383e3af8807afbcdf64eadc30e2b23d4fcf86cf7c4712950d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 613KB
          • SHA256 0bcb5215179d6e340953a3fb7290638235e8fe0e6df8dd27b550046ec29ad6ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 611KB
          • SHA256 60326bb75993d88491d1fc850129b3c35a111b27eddeacf0bd9d4a5aa0b3b3ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 610KB
          • SHA256 60f18be09385bbab6ff3d15633499758156ba795f9ddf7589fc9afb70357e0d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 614KB
          • SHA256 3683eab8f9b8327e0d0e4fed808526d67e5761891de56e9830d4d49ba9c8a3a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 610KB
          • SHA256 3b5e5b822fd464eef021b29b3dea249ee00c42b0dcc20e5d81a5ed068c0e15ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 614KB
          • SHA256 4298300b10d409247b559716aa2e258af073ee5ed1360a661afd8cc856f15db1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 593KB
          • SHA256 b396ff5dd029277bd4c7e6692021dccfec17440ed45c952bf6969b76dd1e0750
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 610KB
          • SHA256 efb5b41d435f11eaf9c8351458c52707556b4197b816a3749bb534e5a72d8f37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 587KB
          • SHA256 9232bda9b5bc8034f95b1b2f13fa065c1c72d110b285a6e426b227b669f40882
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 612KB
          • SHA256 ce489a2429e5ba37912eae6171662084eff3a2b6553d1611d06380907685c946
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 611KB
          • SHA256 c38ba84ba1ad8232e2986e770ffdf42207d8b2bc1cd8f40cdfbff746aab142f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 603KB
          • SHA256 a8b23b4ce8b67dcc13033ce4d0ea15bd574ef15577d4fba0f28401d7f776ebbe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 607KB
          • SHA256 c12ccce1f113843b9c747ddd4f4a92208b38db7fd60a1b53d3ad46279a5b1bcc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 597KB
          • SHA256 1bf526d749b129a8d6d524f3707354aa5756631153687eaef9d9c0d893e61b1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 599KB
          • SHA256 962b2bbf4b95e2d7b43893a661bc8d50b939b96518e13b1d41692ad012bf5d14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 615KB
          • SHA256 fdbcf20484f5a8575c9c287217180a832411548dab048f96d7b488643bd2b7f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 601KB
          • SHA256 be524e535447b05aebd562266df4cb45251cd48f44cee65de0db132797fcabe6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 591KB
          • SHA256 3816cba79f91d6aeb1c87c7abf9163ec00ff3db2210dd398962d6760aedd0f80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 597KB
          • SHA256 363f475e0c23c6d57555321262de987549599728aa9aebf2e7dc4aae0cfa1222
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 607KB
          • SHA256 1270b0b40af014713f4b6b1a9e5138e6d045849d5b690ef0b8740e1238f8b9fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 618KB
          • SHA256 d1e3bd5c8f8fe8d7d5925bb57e7bbfceda0f1df9de483310e840b133eeb43c4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 594KB
          • SHA256 4336301ff127c6b7d52b45e2b800924064610a7aad7a5c5f6475644078a29dea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 602KB
          • SHA256 92c9b11f496a28b3a958cb62763007e1d62fdbcde7879fc639a96a06fbfbdef8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 612KB
          • SHA256 7c6d363130fee795240759743bbf557b0aa167655e00b838f8ff72faee76f434
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 618KB
          • SHA256 58d858ff1e407bae158a3d5feac74ffad9f960b96f79a36cd83ac06cacfbefdc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 602KB
          • SHA256 9c823cbb86d72875a02e117dfb6fa362d22ebb93ca71e5d716ca1cf583635a33
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 604KB
          • SHA256 99621d978d7df6119ca177dfa8bb42d15fcdbc11a388fc09488939faeb5d3829
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 607KB
          • SHA256 b890747f9d7e5ce7e1be4a2eb1565ff3ec8c78ba6ca4e2d4f0947687ebae4fd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 607KB
          • SHA256 e169615e1e16e3003242d5f12e809ae0f96cfc00a4c6d0bff3630bdd421c4681
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 591KB
          • SHA256 1fd9b9f1ecfcd4be41b7ef45a4e231c30cc44dc918eff9e19d7c09552ac011fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 606KB
          • SHA256 2f854155ca9442a435d2a6f950a5b3420aa356584cd4494a694ac0a3b51d90d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 596KB
          • SHA256 467f0b51d14ba269a4c1f6fd0ff2fe5cb5f8b89d2ecaa1a631d1d4e2cc0aa09e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 615KB
          • SHA256 3ba358e70a23d69b849b6b90683d2711fdba6d953f8b8c96e2187d3c3398d62b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 588KB
          • SHA256 09258b9ee8a9c1491fc89c37bda1ea50d01556d776b03a733bacf7583305a0a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 591KB
          • SHA256 da0a20a04d9137bb6094a7342c3476f16b1dfdc622cc619c74523ae70489d932
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 605KB
          • SHA256 a9076e251bef363e2f9a5dab04db3d85b6f9ae121eae399416e53dedbb481c76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 602KB
          • SHA256 7b756c108dc11b608ff6d729c45fc4d4de64065b98f029c562884b94645cba11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 605KB
          • SHA256 ddd92639573a9de33e05a5ad28f1e6f9136d155e9ae0932b3131d960e30c881f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 594KB
          • SHA256 3276be25576a6029a55826c1a9e21c1ff3dea9591ea12e93108a6508bd33a49e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/556-175-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/696-271-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1084-162-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1216-187-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1608-0-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1608-9-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1720-237-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1916-289-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2084-25-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2336-325-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2456-225-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2540-89-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2680-199-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2924-261-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3192-64-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3280-101-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3368-137-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3384-212-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4372-280-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4380-249-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4656-307-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4764-113-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4792-12-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4848-316-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4864-125-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4948-149-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4996-76-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4996-61-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5032-298-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5036-38-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5072-50-0x0000000000400000-0x0000000000430000-memory.dmp
          Download