xtremerat | 5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

982d7a0d9f3d9e6e7780d33257975ddc.exe
Size

404KB
MD5

982d7a0d9f3d9e6e7780d33257975ddc
SHA1

3cff42ac645492a5c6f5787d76ff657205c4281d
SHA256

5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db
SHA512

18952a296c26901bc147c1fc2e657f67d85e3f4307110d26517c3e6fe2782264f4d1a6c2a0856fc16ff24ad52b77480a4c58ed6c29898ac02fa15121e48015a8
SSDEEP

12288:P19Nk9NHoWb2D6dIEGpzK6FSkFvsAeF0CxYgdb2:N9Nk9NvY6i5pzv9enYE2

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

hassan12345.no-ip.biz

Signatures

Detect XtremeRAT payload 23 IoCs

resource	yara_rule
behavioral2/memory/4432-14-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4432-15-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4432-17-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4432-19-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4432-84-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2936-94-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2936-96-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2936-102-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2736-115-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2736-116-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2736-122-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4544-132-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4544-134-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4544-141-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/1904-153-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/1904-159-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2244-170-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2244-173-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2244-178-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3000-189-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3000-190-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3000-195-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/4856-207-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe

Checks computer location settings 2 TTPs 28 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	982d7a0d9f3d9e6e7780d33257975ddc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	hotup.exe

Executes dropped EXE 54 IoCs

pid	Process
1864	hotup.exe
2936	hotup.exe
2276	hotup.exe
2736	hotup.exe
1440	hotup.exe
4544	hotup.exe
3940	hotup.exe
1904	hotup.exe
1292	hotup.exe
2244	hotup.exe
2848	hotup.exe
3000	hotup.exe
332	hotup.exe
4856	hotup.exe
4532	hotup.exe
4296	hotup.exe
1660	hotup.exe
528	hotup.exe
4604	hotup.exe
3520	hotup.exe
2848	hotup.exe
1480	hotup.exe
3008	hotup.exe
2660	hotup.exe
944	hotup.exe
4544	hotup.exe
1000	hotup.exe
3076	hotup.exe
4512	hotup.exe
4776	hotup.exe
3168	hotup.exe
4936	hotup.exe
952	hotup.exe
4668	hotup.exe
3924	hotup.exe
1296	hotup.exe
1224	hotup.exe
4240	hotup.exe
4360	hotup.exe
2144	hotup.exe
4320	hotup.exe
4172	hotup.exe
4512	hotup.exe
2704	hotup.exe
608	hotup.exe
2200	hotup.exe
3728	hotup.exe
3968	hotup.exe
4996	hotup.exe
828	hotup.exe
5008	hotup.exe
5020	hotup.exe
4572	hotup.exe
608	hotup.exe

Adds Run key to start application 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	982d7a0d9f3d9e6e7780d33257975ddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 1864 set thread context of 2936	1864	hotup.exe	100
PID 2276 set thread context of 2736	2276	hotup.exe	113
PID 1440 set thread context of 4544	1440	hotup.exe	123
PID 3940 set thread context of 1904	3940	hotup.exe	133
PID 1292 set thread context of 2244	1292	hotup.exe	143
PID 2848 set thread context of 3000	2848	hotup.exe	154
PID 332 set thread context of 4856	332	hotup.exe	164
PID 4532 set thread context of 4296	4532	hotup.exe	174
PID 1660 set thread context of 528	1660	hotup.exe	184
PID 4604 set thread context of 3520	4604	hotup.exe	194
PID 2848 set thread context of 1480	2848	hotup.exe	204
PID 3008 set thread context of 2660	3008	hotup.exe	214
PID 944 set thread context of 4544	944	hotup.exe	224
PID 1000 set thread context of 3076	1000	hotup.exe	234
PID 4512 set thread context of 4776	4512	hotup.exe	244
PID 3168 set thread context of 4936	3168	hotup.exe	254
PID 952 set thread context of 4668	952	hotup.exe	264
PID 3924 set thread context of 1296	3924	hotup.exe	274
PID 1224 set thread context of 4240	1224	hotup.exe	284
PID 4360 set thread context of 2144	4360	hotup.exe	294
PID 4320 set thread context of 4172	4320	hotup.exe	304
PID 4512 set thread context of 2704	4512	hotup.exe	314
PID 608 set thread context of 2200	608	hotup.exe	324
PID 3728 set thread context of 3968	3728	hotup.exe	334
PID 4996 set thread context of 828	4996	hotup.exe	344
PID 5008 set thread context of 5020	5008	hotup.exe	354
PID 4572 set thread context of 608	4572	hotup.exe	364

Drops file in Windows directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File created	C:\Windows\InstallDir\hotup.exe	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	982d7a0d9f3d9e6e7780d33257975ddc.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	982d7a0d9f3d9e6e7780d33257975ddc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	hotup.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4004	982d7a0d9f3d9e6e7780d33257975ddc.exe
1864	hotup.exe
2276	hotup.exe
1440	hotup.exe
3940	hotup.exe
1292	hotup.exe
2848	hotup.exe
332	hotup.exe
4532	hotup.exe
1660	hotup.exe
4604	hotup.exe
2848	hotup.exe
3008	hotup.exe
944	hotup.exe
1000	hotup.exe
4512	hotup.exe
3168	hotup.exe
952	hotup.exe
3924	hotup.exe
1224	hotup.exe
4360	hotup.exe
4320	hotup.exe
4512	hotup.exe
608	hotup.exe
3728	hotup.exe
4996	hotup.exe
5008	hotup.exe
4572	hotup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4004 wrote to memory of 4432	4004	982d7a0d9f3d9e6e7780d33257975ddc.exe	86
PID 4432 wrote to memory of 2332	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	87
PID 4432 wrote to memory of 2332	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	87
PID 4432 wrote to memory of 2332	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	87
PID 4432 wrote to memory of 2300	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	88
PID 4432 wrote to memory of 2300	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	88
PID 4432 wrote to memory of 2300	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	88
PID 4432 wrote to memory of 848	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	89
PID 4432 wrote to memory of 848	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	89
PID 4432 wrote to memory of 848	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	89
PID 4432 wrote to memory of 4284	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	90
PID 4432 wrote to memory of 4284	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	90
PID 4432 wrote to memory of 4284	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	90
PID 4432 wrote to memory of 1520	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	93
PID 4432 wrote to memory of 1520	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	93
PID 4432 wrote to memory of 1520	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	93
PID 4432 wrote to memory of 2856	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	95
PID 4432 wrote to memory of 2856	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	95
PID 4432 wrote to memory of 2856	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	95
PID 4432 wrote to memory of 3472	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	97
PID 4432 wrote to memory of 3472	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	97
PID 4432 wrote to memory of 3472	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	97
PID 4432 wrote to memory of 1432	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	98
PID 4432 wrote to memory of 1432	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	98
PID 4432 wrote to memory of 1864	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	99
PID 4432 wrote to memory of 1864	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	99
PID 4432 wrote to memory of 1864	4432	982d7a0d9f3d9e6e7780d33257975ddc.exe	99
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 1864 wrote to memory of 2936	1864	hotup.exe	100
PID 2936 wrote to memory of 3508	2936	hotup.exe	101
PID 2936 wrote to memory of 3508	2936	hotup.exe	101
PID 2936 wrote to memory of 3508	2936	hotup.exe	101
PID 2936 wrote to memory of 4040	2936	hotup.exe	103
PID 2936 wrote to memory of 4040	2936	hotup.exe	103
PID 2936 wrote to memory of 4040	2936	hotup.exe	103
PID 2936 wrote to memory of 2436	2936	hotup.exe	104
PID 2936 wrote to memory of 2436	2936	hotup.exe	104
PID 2936 wrote to memory of 2436	2936	hotup.exe	104
PID 2936 wrote to memory of 1760	2936	hotup.exe	105
PID 2936 wrote to memory of 1760	2936	hotup.exe	105
PID 2936 wrote to memory of 1760	2936	hotup.exe	105

C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
"C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
  C:\Users\Admin\AppData\Local\Temp\982d7a0d9f3d9e6e7780d33257975ddc.exe
  2⤵
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1432
- - C:\Windows\InstallDir\hotup.exe
    "C:\Windows\InstallDir\hotup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\InstallDir\hotup.exe
      C:\Windows\InstallDir\hotup.exe
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3440
    - - C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2452
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3316
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3940
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        10⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4844
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        12⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4488
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        14⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:5028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3420
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        16⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:1700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:744
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        18⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:720
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        20⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:5060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4420
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4604
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        22⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:2088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:1436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4060
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        24⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3996
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        26⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:1572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:1108
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:944
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        28⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:3128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:3992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:1696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:800
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1000
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        30⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:5052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:2572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4732
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        32⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:4484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:2440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:3008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        33⤵
        
        PID:1144
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3168
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        34⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:2396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:5096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:2364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        35⤵
        
        PID:4364
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:952
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        36⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:2388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:1084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:4704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:2848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:1388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        37⤵
        
        PID:1796
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3924
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        38⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        39⤵
        
        PID:3224
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        40⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:1044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:2372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:4012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:3940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        41⤵
        
        PID:3168
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        42⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:1660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:3896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:1424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:2976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        43⤵
        
        PID:5016
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4320
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        44⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:1416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:1192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:3000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:3768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        45⤵
        
        PID:448
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        46⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:1488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:4004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:1908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:2428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        47⤵
        
        PID:636
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:608
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        48⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:1964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:4260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:3712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        49⤵
        
        PID:2712
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3728
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        50⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:4292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:3216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:3336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        51⤵
        
        PID:2260
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4996
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        52⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:2928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:4584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:3424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:1916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:2688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:2172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        53⤵
        
        PID:4824
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5008
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        54⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:2360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:1048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:3412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:1376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        55⤵
        
        PID:3932
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        56⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:1272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:1296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:2932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:1252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:5080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        57⤵
        
        PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Fc0sBH.cfg

Filesize
1KB

MD5
9c4284f5cf565126e9f24fd35cc5f22f

SHA1
bd9bddfe09293701691849dc26f95bc9b104b005

SHA256
f558a02382c1ea6d548201b38808556b116c62fea2d75e39f9011bdba51bd183

SHA512
e798692f027d4f618af2c83e7615167116b531fcbf1e2dfcfc493c55640cda257cb8d5ddb5384fc09cbc8151cce60f5154248927b53ff8492d83fde9bf56d752

Download Submit
C:\Windows\InstallDir\hotup.exe

Filesize
404KB

MD5
982d7a0d9f3d9e6e7780d33257975ddc

SHA1
3cff42ac645492a5c6f5787d76ff657205c4281d

SHA256
5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db

SHA512
18952a296c26901bc147c1fc2e657f67d85e3f4307110d26517c3e6fe2782264f4d1a6c2a0856fc16ff24ad52b77480a4c58ed6c29898ac02fa15121e48015a8

Download Submit
memory/332-206-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/332-201-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/332-199-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/332-197-0x00000000021F0000-0x000000000224A000-memory.dmp

Filesize
360KB

Download
memory/944-316-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1000-333-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1292-171-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1292-165-0x0000000003A20000-0x0000000003B20000-memory.dmp

Filesize
1024KB

Download
memory/1292-163-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/1292-161-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1292-160-0x0000000002060000-0x00000000020BA000-memory.dmp

Filesize
360KB

Download
memory/1292-166-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1292-172-0x0000000002060000-0x00000000020BA000-memory.dmp

Filesize
360KB

Download
memory/1440-128-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1440-123-0x0000000002780000-0x00000000027DA000-memory.dmp

Filesize
360KB

Download
memory/1440-125-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/1440-126-0x0000000003A50000-0x0000000003A60000-memory.dmp

Filesize
64KB

Download
memory/1440-133-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1440-135-0x0000000002780000-0x00000000027DA000-memory.dmp

Filesize
360KB

Download
memory/1660-244-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1864-95-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1864-90-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/1864-97-0x0000000002220000-0x000000000227A000-memory.dmp

Filesize
360KB

Download
memory/1864-89-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1864-86-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/1864-85-0x0000000002220000-0x000000000227A000-memory.dmp

Filesize
360KB

Download
memory/1904-159-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1904-153-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2244-173-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2244-170-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2244-178-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2276-104-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2276-110-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/2276-114-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2276-117-0x0000000002080000-0x00000000020DA000-memory.dmp

Filesize
360KB

Download
memory/2276-109-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/2276-107-0x0000000003A50000-0x0000000003A60000-memory.dmp

Filesize
64KB

Download
memory/2276-105-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/2276-103-0x0000000002080000-0x00000000020DA000-memory.dmp

Filesize
360KB

Download
memory/2736-115-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2736-116-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2736-122-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2848-182-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/2848-179-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2848-279-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2848-191-0x0000000002030000-0x000000000208A000-memory.dmp

Filesize
360KB

Download
memory/2848-188-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2848-184-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/2848-180-0x0000000002030000-0x000000000208A000-memory.dmp

Filesize
360KB

Download
memory/2936-102-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2936-94-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2936-96-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3000-195-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3000-190-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3000-189-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3008-298-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3940-146-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/3940-152-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3940-154-0x00000000021D0000-0x000000000222A000-memory.dmp

Filesize
360KB

Download
memory/3940-147-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/3940-142-0x00000000021D0000-0x000000000222A000-memory.dmp

Filesize
360KB

Download
memory/3940-144-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/4004-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4004-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4004-7-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/4004-10-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download
memory/4004-1-0x0000000002320000-0x000000000237A000-memory.dmp

Filesize
360KB

Download
memory/4004-12-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/4004-2-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/4004-5-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4004-16-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4004-13-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

Filesize
4KB

Download
memory/4004-9-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Filesize
4KB

Download
memory/4004-3-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/4004-18-0x0000000002320000-0x000000000237A000-memory.dmp

Filesize
360KB

Download
memory/4004-6-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/4432-17-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4432-15-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4432-14-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4432-19-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4432-84-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4512-352-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4532-224-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4544-134-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4544-141-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4544-132-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4604-262-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4856-207-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads