xtremerat | 5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

982d7a0d9f3d9e6e7780d33257975ddc.exe
Size

404KB
MD5

982d7a0d9f3d9e6e7780d33257975ddc
SHA1

3cff42ac645492a5c6f5787d76ff657205c4281d
SHA256

5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db
SHA512

18952a296c26901bc147c1fc2e657f67d85e3f4307110d26517c3e6fe2782264f4d1a6c2a0856fc16ff24ad52b77480a4c58ed6c29898ac02fa15121e48015a8
SSDEEP

12288:P19Nk9NHoWb2D6dIEGpzK6FSkFvsAeF0CxYgdb2:N9Nk9NvY6i5pzv9enYE2

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

hassan12345.no-ip.biz

Signatures

Detect XtremeRAT payload 18 IoCs

resource	yara_rule
behavioral1/memory/2828-15-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2828-16-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2828-17-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2828-20-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2828-38-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1868-50-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1868-53-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2592-66-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2592-71-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1200-85-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1200-88-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1928-101-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1928-106-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1832-112-0x00000000035A0000-0x00000000036A0000-memory.dmp	family_xtremerat
behavioral1/memory/644-119-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/644-122-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1848-135-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1848-140-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	982d7a0d9f3d9e6e7780d33257975ddc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	982d7a0d9f3d9e6e7780d33257975ddc.exe

Executes dropped EXE 54 IoCs

pid	Process
2448	hotup.exe
1868	hotup.exe
2176	hotup.exe
2592	hotup.exe
1732	hotup.exe
1200	hotup.exe
2600	hotup.exe
1928	hotup.exe
1832	hotup.exe
644	hotup.exe
1628	hotup.exe
1848	hotup.exe
2392	hotup.exe
892	hotup.exe
2236	hotup.exe
2556	hotup.exe
2664	hotup.exe
2668	hotup.exe
1444	hotup.exe
848	hotup.exe
2444	hotup.exe
1876	hotup.exe
3024	hotup.exe
1316	hotup.exe
2108	hotup.exe
2764	hotup.exe
2152	hotup.exe
3048	hotup.exe
1164	hotup.exe
704	hotup.exe
1876	hotup.exe
1384	hotup.exe
2276	hotup.exe
1724	hotup.exe
2676	hotup.exe
3004	hotup.exe
704	hotup.exe
2004	hotup.exe
1948	hotup.exe
2916	hotup.exe
1660	hotup.exe
768	hotup.exe
2108	hotup.exe
2056	hotup.exe
2664	hotup.exe
3008	hotup.exe
1724	hotup.exe
2428	hotup.exe
2912	hotup.exe
3112	hotup.exe
3260	hotup.exe
3296	hotup.exe
3448	hotup.exe
3488	hotup.exe

Loads dropped DLL 3 IoCs

pid	Process
2828	982d7a0d9f3d9e6e7780d33257975ddc.exe
2828	982d7a0d9f3d9e6e7780d33257975ddc.exe
2448	hotup.exe

Adds Run key to start application 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2448 set thread context of 1868	2448	hotup.exe	38
PID 2176 set thread context of 2592	2176	hotup.exe	48
PID 1732 set thread context of 1200	1732	hotup.exe	58
PID 2600 set thread context of 1928	2600	hotup.exe	68
PID 1832 set thread context of 644	1832	hotup.exe	78
PID 1628 set thread context of 1848	1628	hotup.exe	88
PID 2392 set thread context of 892	2392	hotup.exe	98
PID 2236 set thread context of 2556	2236	hotup.exe	108
PID 2664 set thread context of 2668	2664	hotup.exe	118
PID 1444 set thread context of 848	1444	hotup.exe	130
PID 2444 set thread context of 1876	2444	hotup.exe	140
PID 3024 set thread context of 1316	3024	hotup.exe	150
PID 2108 set thread context of 2764	2108	hotup.exe	160
PID 2152 set thread context of 3048	2152	hotup.exe	170
PID 1164 set thread context of 704	1164	hotup.exe	180
PID 1876 set thread context of 1384	1876	hotup.exe	190
PID 2276 set thread context of 1724	2276	hotup.exe	200
PID 2676 set thread context of 3004	2676	hotup.exe	210
PID 704 set thread context of 2004	704	hotup.exe	220
PID 1948 set thread context of 2916	1948	hotup.exe	230
PID 1660 set thread context of 768	1660	hotup.exe	240
PID 2108 set thread context of 2056	2108	hotup.exe	250
PID 2664 set thread context of 3008	2664	hotup.exe	260
PID 1724 set thread context of 2428	1724	hotup.exe	270
PID 2912 set thread context of 3112	2912	hotup.exe	280
PID 3260 set thread context of 3296	3260	hotup.exe	290
PID 3448 set thread context of 3488	3448	hotup.exe	300

Drops file in Windows directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File created	C:\Windows\InstallDir\hotup.exe	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2212	982d7a0d9f3d9e6e7780d33257975ddc.exe
2448	hotup.exe
2176	hotup.exe
1732	hotup.exe
2600	hotup.exe
1832	hotup.exe
1628	hotup.exe
2392	hotup.exe
2236	hotup.exe
2664	hotup.exe
1444	hotup.exe
2444	hotup.exe
3024	hotup.exe
2108	hotup.exe
2152	hotup.exe
1164	hotup.exe
1876	hotup.exe
2276	hotup.exe
2676	hotup.exe
704	hotup.exe
1948	hotup.exe
1660	hotup.exe
2108	hotup.exe
2664	hotup.exe
1724	hotup.exe
2912	hotup.exe
3260	hotup.exe
3448	hotup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2212 wrote to memory of 2828	2212	982d7a0d9f3d9e6e7780d33257975ddc.exe	28
PID 2828 wrote to memory of 2820	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	29
PID 2828 wrote to memory of 2820	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	29
PID 2828 wrote to memory of 2820	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	29
PID 2828 wrote to memory of 2820	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	29
PID 2828 wrote to memory of 2820	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	29
PID 2828 wrote to memory of 2840	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	30
PID 2828 wrote to memory of 2840	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	30
PID 2828 wrote to memory of 2840	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	30
PID 2828 wrote to memory of 2840	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	30
PID 2828 wrote to memory of 2840	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	30
PID 2828 wrote to memory of 2896	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	31
PID 2828 wrote to memory of 2896	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	31
PID 2828 wrote to memory of 2896	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	31
PID 2828 wrote to memory of 2896	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	31
PID 2828 wrote to memory of 2896	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	31
PID 2828 wrote to memory of 2808	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	32
PID 2828 wrote to memory of 2808	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	32
PID 2828 wrote to memory of 2808	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	32
PID 2828 wrote to memory of 2808	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	32
PID 2828 wrote to memory of 2808	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	32
PID 2828 wrote to memory of 2776	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	33
PID 2828 wrote to memory of 2776	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	33
PID 2828 wrote to memory of 2776	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	33
PID 2828 wrote to memory of 2776	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	33
PID 2828 wrote to memory of 2776	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	33
PID 2828 wrote to memory of 2744	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	34
PID 2828 wrote to memory of 2744	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	34
PID 2828 wrote to memory of 2744	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	34
PID 2828 wrote to memory of 2744	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	34
PID 2828 wrote to memory of 2744	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	34
PID 2828 wrote to memory of 2724	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	35
PID 2828 wrote to memory of 2724	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	35
PID 2828 wrote to memory of 2724	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	35
PID 2828 wrote to memory of 2724	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	35
PID 2828 wrote to memory of 2724	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	35
PID 2828 wrote to memory of 2060	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	36
PID 2828 wrote to memory of 2060	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	36
PID 2828 wrote to memory of 2060	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	36
PID 2828 wrote to memory of 2060	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	36
PID 2828 wrote to memory of 2448	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	37
PID 2828 wrote to memory of 2448	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	37
PID 2828 wrote to memory of 2448	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	37
PID 2828 wrote to memory of 2448	2828	982d7a0d9f3d9e6e7780d33257975ddc.exe	37
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38
PID 2448 wrote to memory of 1868	2448	hotup.exe	38

C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
"C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
  C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
  2⤵
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2840
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2896
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2808
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2776
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2744
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2724
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2060
- - C:\Windows\InstallDir\hotup.exe
    "C:\Windows\InstallDir\hotup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\InstallDir\hotup.exe
      C:\Windows\InstallDir\hotup.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      PID:1868
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2096
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:292
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1988
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1584
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2888
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3052
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1120
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1700
    - - C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2688
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2260
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1488
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1984
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        14⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:832
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        16⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1812
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        18⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2792
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        20⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2452
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2928
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1444
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        22⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:600
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        24⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:644
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        26⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1624
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        28⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2508
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2696
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2152
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        30⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2880
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        32⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1840
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        34⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:764
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        36⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2616
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        38⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1164
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:844
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:704
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        40⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2788
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        42⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2252
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        44⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1564
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        46⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2020
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        48⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:992
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        50⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:1948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:1048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:1996
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        52⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3184
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3236
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3260
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        54⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3424
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3448
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        56⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3488
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3620
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        57⤵
        
        PID:3648
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        58⤵
        
        PID:3680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3796
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        59⤵
        
        PID:3824
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        60⤵
        
        PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Fc0sBH.cfg

Filesize
1KB

MD5
9c4284f5cf565126e9f24fd35cc5f22f

SHA1
bd9bddfe09293701691849dc26f95bc9b104b005

SHA256
f558a02382c1ea6d548201b38808556b116c62fea2d75e39f9011bdba51bd183

SHA512
e798692f027d4f618af2c83e7615167116b531fcbf1e2dfcfc493c55640cda257cb8d5ddb5384fc09cbc8151cce60f5154248927b53ff8492d83fde9bf56d752

Download Submit
C:\Windows\InstallDir\hotup.exe

Filesize
404KB

MD5
982d7a0d9f3d9e6e7780d33257975ddc

SHA1
3cff42ac645492a5c6f5787d76ff657205c4281d

SHA256
5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db

SHA512
18952a296c26901bc147c1fc2e657f67d85e3f4307110d26517c3e6fe2782264f4d1a6c2a0856fc16ff24ad52b77480a4c58ed6c29898ac02fa15121e48015a8

Download Submit
memory/644-122-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/644-119-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1164-282-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1200-85-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1200-88-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1444-201-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1628-133-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1628-123-0x00000000023F0000-0x000000000244A000-memory.dmp

Filesize
360KB

Download
memory/1628-125-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1628-128-0x0000000003610000-0x0000000003620000-memory.dmp

Filesize
64KB

Download
memory/1628-129-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/1628-127-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1628-136-0x00000000023F0000-0x000000000244A000-memory.dmp

Filesize
360KB

Download
memory/1732-78-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/1732-72-0x0000000002360000-0x00000000023BA000-memory.dmp

Filesize
360KB

Download
memory/1732-76-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1732-83-0x0000000002360000-0x00000000023BA000-memory.dmp

Filesize
360KB

Download
memory/1732-74-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1732-82-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1732-77-0x00000000035A0000-0x00000000036A0000-memory.dmp

Filesize
1024KB

Download
memory/1832-111-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1832-112-0x00000000035A0000-0x00000000036A0000-memory.dmp

Filesize
1024KB

Download
memory/1832-110-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1832-113-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/1832-117-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1832-108-0x0000000000380000-0x00000000003DA000-memory.dmp

Filesize
360KB

Download
memory/1848-135-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1848-140-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1868-53-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1868-50-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1928-106-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1928-101-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2108-250-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2152-266-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2176-58-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2176-59-0x0000000003610000-0x0000000003620000-memory.dmp

Filesize
64KB

Download
memory/2176-63-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2176-61-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2176-89-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2176-57-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2176-55-0x00000000002C0000-0x000000000031A000-memory.dmp

Filesize
360KB

Download
memory/2212-7-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2212-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2212-1-0x00000000004D0000-0x000000000052A000-memory.dmp

Filesize
360KB

Download
memory/2212-14-0x0000000003860000-0x0000000003925000-memory.dmp

Filesize
788KB

Download
memory/2212-18-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2212-9-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2212-12-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2212-13-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/2212-8-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2212-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2212-19-0x00000000004D0000-0x000000000052A000-memory.dmp

Filesize
360KB

Download
memory/2212-6-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2212-5-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2212-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2212-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2236-167-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2392-145-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2392-142-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2392-150-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2392-146-0x00000000035A0000-0x00000000036A0000-memory.dmp

Filesize
1024KB

Download
memory/2392-144-0x0000000001D40000-0x0000000001D9A000-memory.dmp

Filesize
360KB

Download
memory/2444-216-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2448-40-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2448-41-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2448-42-0x0000000001CC0000-0x0000000001D1A000-memory.dmp

Filesize
360KB

Download
memory/2448-47-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2448-37-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2592-66-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2592-71-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2600-94-0x00000000035A0000-0x00000000036A0000-memory.dmp

Filesize
1024KB

Download
memory/2600-95-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2600-93-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2600-98-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2600-91-0x0000000000340000-0x000000000039A000-memory.dmp

Filesize
360KB

Download
memory/2664-184-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2828-16-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2828-35-0x00000000033D0000-0x0000000003495000-memory.dmp

Filesize
788KB

Download
memory/2828-17-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2828-38-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2828-20-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2828-15-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3024-233-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads