Overview

overview

10

Static

static

5

57124d7c0c...7f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 19:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
  • Size 548KB
  • Sample260910-xsqfjsfp9v
  • SHA256 57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 58 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
    "C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:2476
    • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
      C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
        C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
          C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3652
          • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
            C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1680
            • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
              C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4440
              • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2492
                • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                  C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3628
                  • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                    C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2232
                    • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                      C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3204
                      • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                        C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3228
                        • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                          C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4992
                          • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                            C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1712
                            • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                              C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:844
                              • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:380
                                • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                  C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2340
                                  • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                    C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4424
                                    • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                      C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:1460
                                      • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                        C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Adds Run key to start application
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3980
                                        • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                          C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:2400
                                          • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                            C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:4704
                                            • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                              C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:1440
                                              • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4988
                                                • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                  C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4184
                                                  • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                    C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4400
                                                    • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                      C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:564
                                                      • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                        C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:628
                                                        • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                          C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1248
                                                          • C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                            C:\Users\Admin\AppData\Local\Temp\57124d7c0c0924fd2f60d581d38bfecc3aa0ad74d4ec6d770c78b1f566efdf7f.exe
                                                            29⤵
                                                            • Drops file in Drivers directory
                                                            PID:3128
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:4704
  • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
    "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4980

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Browser Extensions

        1
        T1176

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\AppData\Local\cftmon.exe
        • Size 558KB
        • SHA256 710a0b07252be00eabfbf70106b0df8e936404527b7f76fa58fcaf8a40d29190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 566KB
        • SHA256 01cdaa19a13dcdc2b7f2b8478ce02f9a8650afdb6aea6e5052967f4082acc2ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 575KB
        • SHA256 845145d18cdcb8ac97c8fa36e7f5d7388ad32ab5c0032c76478e864196af30c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 575KB
        • SHA256 5247ec52b41da13363f667836dac7b1a6eaf4bc5dbed0e1e29b928b33a8814c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 576KB
        • SHA256 ed29a7c9f389cc014bdd53d2f0637416ea6a65f9db93f24384db4f8ac7dd64b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 558KB
        • SHA256 e35a63d8343032226f915309ad520eb8e88115b37652f9f82167c7010ee5a69c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 548KB
        • SHA256 e2d8af8cdff2fb173e6063e31ef1076201a130ce1ab3886fe0cec3033a72c757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 554KB
        • SHA256 a53e9f3ba42335735a23c73ce7f27cf1ffa20f25b52cdaf9e3833b84e061c5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 557KB
        • SHA256 0dbfa1b12acdcdb1140b46d5487259d115b3a4e54b4b4b32f5f5f53c6c276f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 578KB
        • SHA256 dde9d6fc205317bf1b331a535f720ac9d14d79b8a1a5dbeb23db1b301dc04937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 576KB
        • SHA256 9d2706167fb71b9c2f1244ba02d1b30b464830d98ef299799d87bac45f28b0a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 575KB
        • SHA256 cc22d3944fb7610784896ac99ef5363fbadebfcd5ccf4566cf272a8358c93521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 570KB
        • SHA256 96e1acffac92a0df9b7bcb9ea547307b96d5f778fed95a954c79982af09a5063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 564KB
        • SHA256 c555428c9dc2c979609c025ed5d5f80572bca713f8fe7e6c9b696a21b164e1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 552KB
        • SHA256 87a3919280a4ecfe05c80f301103e89ab32f35fb531289b8193096d5840ded28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 564KB
        • SHA256 1af6280bb41887b475cb1037484a29371872f8ccecb6e354cc90bc00d99ee068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 560KB
        • SHA256 4669800d6c5cef281b26a71947078876ae95eaae26699179b072983ce8e7ab6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 564KB
        • SHA256 599a278a6d90e9ed85cc1feda21da7cf138802b3829855d28aa5801cbd9d31be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 557KB
        • SHA256 b503f42d01334dad9d551eb31aa479dccbcab3e8d962a6a9ecde29043404dac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 573KB
        • SHA256 2d1516c82f8c0d162420ac40ba2ae90fc8d3cfe45c63c05ecfa2100037b3106d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 549KB
        • SHA256 2305d63cd087f98d21aaff98566632cf41f0776de4b3672d2847b0b93297644c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 561KB
        • SHA256 ebf9df36a8834f0954facecdbd8d129c4dd4173b3fb360930db8d0d8a3b33fc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 569KB
        • SHA256 5cf516c3b4d4167326eb4e56985ca369ad19c360190c84a7c698daa39397bb41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 567KB
        • SHA256 c5086df44c4dc5ae0da51550439a5e1634bb638a06553757eb96f67f78ec138e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 552KB
        • SHA256 80b9222d5c8cd9883ba26ced7304299aa50fe28b5f85f5beb1c7f4d247ce78a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 553KB
        • SHA256 66129f5857ac5f173cb5343f473a6728042ababa3d0b13effee04a20c54dae25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 556KB
        • SHA256 6ed955ba60591debbb9085abf663bd25754f7692ff2f91fbb149c019fd94dc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 559KB
        • SHA256 dee4ce1c36ecdf2480059a7a9b360ec9cc5636a5fc80fbe18dd6c4ae58cd3cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 572KB
        • SHA256 a549480fbe0428cc00cd4c1a8feffc7ded2f0a8b618745692ff6875b4b6f2ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 556KB
        • SHA256 3a0a686efb56076a7e546e91451041c85f8e5caca1ca1387bb760ade132d564f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 548KB
        • SHA256 cce862a1be4345dc6c1a1a4bfd61a08134756ad666f68b9cd6af5f895adb6c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 569KB
        • SHA256 0d250e256e34ac5fd6dc0897520e03dadb4056aeb51767e7b32cb317ac83a1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 553KB
        • SHA256 dba260ce5109c032c18d4d182d7b45e1c52ea0508fb2fe93fea9316d3897a53b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 567KB
        • SHA256 2386cf868399b3b1172f8c62bf145fb2e4e5c19e93bbccf0982b413fb2c9daf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 556KB
        • SHA256 d62551e055030da28906457343b3df15cb86c379c17eb693157137e735e043a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 572KB
        • SHA256 de20f6a95e2ae5b72b9d7b57cca459ce309a326c430b234bad2457f30d04fc3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 577KB
        • SHA256 9ee82d73ce67500bfeac0983e9b79cea9a879675a0ea1ae84bc96c092e2bfd38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 564KB
        • SHA256 166ad5d45e7f4a45adadfb9a7853cf34bde601f2c0935214b5a1d34b5905da30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 554KB
        • SHA256 53d6a387f843b59c43eda3c2ef42cb951df157e396b0989526a0068c53968474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 569KB
        • SHA256 68885dae5ab834fe10d0b50a050f04214f7a2deebb35a432672dadb31f1beea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 567KB
        • SHA256 c614c991c905ae92607a83c43f6608f2e569ea4dd1fadbf27356655571ee1c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 551KB
        • SHA256 06f6c31aa45c63d8f0e3bb641252b8754bd457fab057e18ce18e76a756fc3c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/380-183-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/564-301-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/628-310-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/844-171-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1248-319-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1440-265-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1460-219-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1620-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1620-0-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1680-48-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1680-63-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1708-25-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/1712-159-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2232-111-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2340-195-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2400-243-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2492-87-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2956-37-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3204-123-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3228-135-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3628-99-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3652-51-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/3980-231-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4184-283-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4400-292-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4424-207-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4440-75-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4704-255-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4980-12-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4988-274-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/4992-147-0x0000000000400000-0x0000000000430000-memory.dmp
        Download