Overview

overview

10

Static

static

5

552bb74b83...2e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
  • Size 1.2MB
  • Sample260910-xc9t9afn2x
  • SHA256 552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
    "C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:2552
    • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
      C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
        C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
          C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
            C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3780
            • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
              C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4204
              • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3064
                • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                  C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:924
                  • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                    C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3936
                    • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                      C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3480
                      • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                        C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4976
                        • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                          C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2692
                          • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                            C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1180
                            • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                              C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2924
                              • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4392
                                • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                  C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4356
                                  • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                    C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1156
                                    • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                      C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:4912
                                      • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                        C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3924
                                        • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                          C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:2552
                                          • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                            C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1680
                                            • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                              C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:4420
                                              • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:5004
                                                • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                  C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3068
                                                  • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                    C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:964
                                                    • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                      C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1272
                                                      • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                        C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:768
                                                        • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                          C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1996
                                                          • C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                            C:\Users\Admin\AppData\Local\Temp\552bb74b836f00262aa2258ab06502d4c2572e076d50d043a63436f225fd072e.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:1788
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:3968
  • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
    "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5088

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Browser Extensions

        1
        T1176

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\AppData\Local\cftmon.exe
        • Size 1.2MB
        • SHA256 c46e599f186f2653be574d3f5add284f79b02fc201d8c955753ee6928d8fbbd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 871a314e13285dc52afb7f77c42fbae5db9cc0ab8799fddd3c5389907b4407fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 35f2e2b9939f8864259f64b4f4118b3b381e938fa73d34b62390dde2fa9c01fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 af0170955efaa5ff34023a40eda5a20195e726df47e86099e0c9a1b2ea01b9fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 edcac33fec274d3d5da740c7ffcdb86342eb54bb6dcd1e8e82e1accc4f9e8bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 a076631cbbb54d17ab03377e45dd2dd2fc49558fefc43a23407c01679883d068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 5eabcbdb6fb4772b197f345b2474e066218026f7f7ac6a6e83ad1794c46da56c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 808ee501a15fdf01ce40bd60ba48e69a87fa63a92f27e615725a183e7b25a258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 1506145ba5b507d91c109f120847330338d95dfd5dc79b5998c1c725fb9a182b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 2944fa41272f93a5d3c30d2ac1256ea0a36931729ce7e70a73e5df0eb9cc0185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 a8441f36e26af6426e2b6c638e72bdee856dd4d2e80355ebafa05e2d459b1d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 2d416e7db248f6b0428b646cb922bc35193cc11d235a72aaa990ccce568df708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 7557b7e88957e5255e47ef43c0f791a91ee7494cea01081e2ca13fba1bf9935d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 068bfd265e23b8910e742f3cddece249c5f0b02827d9a9c920171e766868b2e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 44ddd2e732ab31ecee8b9b20d4ef9e708783a8169d46f0f55c2e8e1f9217dd64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 18aedc7c2754b0b7c1fd41b00d729c36150597ef3070be1792a82abc70a06dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 3377a3c83eab02b980eef1d812e3a952113b8812ee615e3f9e40d83adde52f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 9122bb6beb24b2ea9b5dbfc2505d96a26d6f631d51d5a56cd864d912bfcaa693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 2719f87d25339fab504c1a4aa5933c652d99632db539234614583aa6ba4853eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 3cc80b432cf0dc25fa1b65ede564a8eb3d96cd39ce684deac805e29faa540442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 1.2MB
        • SHA256 05f0e73711201b0c0342781a4ea669965c25f84bef6ecfabbe63e90f123aee94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 29a5826fb62d53a34b0da86557c9c420299697250357b223a0a18cd875007840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 1fa54f91dd57b9ca93f9e9b684873bb54e8d25166213da889cdd7a940642e3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 09f6db0ae04c0e348618ed098a6d785c827d9fa60effeeb212750b55de5f9388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 340074590bcce54fc5bda5348a1260a644a620bc3a9365895c670c3a04507460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 796412003290272f18e6a427c300039992b372ec77cda97869951e47327d1988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 ecae3f0e415a6bea1099c38cf355833561bbd37ac6a083346bcc699e5deeb0a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 6829e58605dbb4b179f1ee9c6b01dd553484b033eea6b312cc74c27611a6af83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 be2c4b42e16771c7582a9507e287a2b70e28ced0d79d7b30cf15069978e50f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 f8d3dbd79aded6afa04c715863d2cf7c4fb7f0357b16542e05f814820a03c9d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 ae2baa66cf5007027561fe2f7d180a42f3451ca6b873eeb9ffbbea07c882c6e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 5194561abe724282523e766620f5de3b64e753462ad289e5a09b6bc3b3c4d948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 16219a527b8777d9aca754252c8ee6a8df0ad1ffbb31d57d4d3d77f720c3fe78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 204d8e475d774993d747dfe7caa59fd163f3ca9d6c727ea8b69143ccec44d789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 170df339a92013617c5b02e6706bf1b15c94bb74b51a1af1c7ae1d93c7b19f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 d55b5fa80ba4c7c158790d1e8615a8cce8eab24c47af169ce8164f9b07fc356f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 c48c6da4cd839f7e80d49fff04bb4193b4854ab19fe962b031332f662695583a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 ed54af80eff03af869a49e7a423bbe58e5bebe51b5538cfcab1c57a0fb65ae21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 02b77f9960b96b1f87577e7fab83cdc00445faa2354e83d9361993d8b5be925c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 a4724d7a0a67a73501ac782c4427863d5e3d63a798bc9335b850d711c6c1fce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 c30bb6365e579e9062e83384452e8c5dfe448bc373554287b0b421e2d1732368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 1.2MB
        • SHA256 3016a9e35a94ca904d29b12f4b759e16bacf9fb7536d4dcada803574f7ac7b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/768-318-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/924-100-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/964-300-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1012-38-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1156-213-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1180-164-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1260-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1260-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1272-309-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1680-262-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1996-327-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2192-24-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2416-33-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2416-51-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2552-250-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2692-151-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2924-177-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3064-88-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3068-290-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3480-125-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3780-63-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3924-238-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3936-113-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4204-76-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4356-201-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4392-189-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4420-272-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4912-226-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4976-138-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5004-281-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/5088-12-0x0000000000400000-0x0000000000430000-memory.dmp
        Download