xtremerat | 799bc643cfd5b436e6226d5c42e3bef2cae2a4dcd5839924acfcd10fd403036b

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afb2547a6a546a00e640e6ad45594247.exe
Size 351KB
Sample240229-211cyafd88
SHA256 799bc643cfd5b436e6226d5c42e3bef2cae2a4dcd5839924acfcd10fd403036b
MD5 afb2547a6a546a00e640e6ad45594247
SHA1 fa5bde5996e5108a45d3d5a22d9c17acdad08264
SHA512 8abfbb256d8b78bdb4e2046996c8a589062e416cd32935642bde463acbe341e0582ded3dffb9fe736875ea62bcb1f42e1996156e1af7cbea36d2bebf8047115c
SSDEEP 3072:PrMUbMvKPFqJHOULc5kAVerPSfa+S1b7ziXFFJyiyO9BeBg5LfhVGjkVBw/TMGZT:j8a/S1OzJ7DDfhVGGIzxpXkIdZr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 32 IoCs

resource	yara_rule
behavioral1/memory/2920-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2920-17-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2244-26-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2920-33-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2488-50-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/548-75-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2488-87-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/548-114-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/548-118-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1868-147-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2196-148-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1868-152-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1916-168-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2804-179-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2196-195-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3016-197-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2196-206-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1916-219-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1916-223-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3016-251-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2424-253-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3052-258-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3016-265-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2944-281-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2316-282-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/3052-288-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2424-298-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1976-299-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2316-303-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2944-302-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2424-311-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1700-339-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	afb2547a6a546a00e640e6ad45594247.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\system32\\InstallDir\\ctfmon.exe restart"	afb2547a6a546a00e640e6ad45594247.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\system32\\InstallDir\\ctfmon.exe restart"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe

Executes dropped EXE 64 IoCs

pid	Process
2420	ctfmon.exe
2488	ctfmon.exe
2712	ctfmon.exe
548	ctfmon.exe
2180	ctfmon.exe
1868	ctfmon.exe
1040	ctfmon.exe
1428	ctfmon.exe
2804	ctfmon.exe
2196	ctfmon.exe
692	ctfmon.exe
1916	ctfmon.exe
2136	ctfmon.exe
1972	ctfmon.exe
3016	ctfmon.exe
2608	ctfmon.exe
3052	ctfmon.exe
2536	ctfmon.exe
2944	ctfmon.exe
2424	ctfmon.exe
2456	ctfmon.exe
2704	ctfmon.exe
2316	ctfmon.exe
1976	ctfmon.exe
1044	ctfmon.exe
1888	ctfmon.exe
1528	ctfmon.exe
1700	ctfmon.exe
2520	ctfmon.exe
1740	ctfmon.exe
2260	ctfmon.exe
2980	ctfmon.exe
2140	ctfmon.exe
2160	ctfmon.exe
2944	ctfmon.exe
1232	ctfmon.exe
2380	ctfmon.exe
1528	ctfmon.exe
1956	ctfmon.exe
2208	ctfmon.exe
2360	ctfmon.exe
1052	ctfmon.exe
1096	ctfmon.exe
1924	ctfmon.exe
2124	ctfmon.exe
2868	ctfmon.exe
1548	ctfmon.exe
2260	ctfmon.exe
1528	ctfmon.exe
1904	ctfmon.exe
1648	ctfmon.exe
3028	ctfmon.exe
2160	ctfmon.exe
1312	ctfmon.exe
1528	ctfmon.exe
2468	ctfmon.exe
884	ctfmon.exe
2772	ctfmon.exe
3024	ctfmon.exe
1700	ctfmon.exe
3092	ctfmon.exe
3124	ctfmon.exe
3312	ctfmon.exe
3344	ctfmon.exe

Loads dropped DLL 64 IoCs

pid	Process
2920	afb2547a6a546a00e640e6ad45594247.exe
2920	afb2547a6a546a00e640e6ad45594247.exe
2244	svchost.exe
2244	svchost.exe
2488	ctfmon.exe
2488	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
548	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
1956	ctfmon.exe
2208	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
3028	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
3868	ctfmon.exe
3900	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
4360	ctfmon.exe
4360	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
4732	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
4932	ctfmon.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2920-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-10-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-13-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-15-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-17-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2244-26-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2920-33-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2488-50-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/548-75-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2488-87-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/548-114-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/548-118-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1868-147-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2196-148-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1868-152-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1916-168-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2804-179-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2196-195-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3016-197-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2196-206-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1916-219-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1916-223-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3016-251-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2424-253-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3052-258-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3016-265-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2944-281-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2316-282-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/3052-288-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2424-298-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1976-299-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2316-303-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2944-302-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2424-311-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1700-339-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\system32\\InstallDir\\ctfmon.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	afb2547a6a546a00e640e6ad45594247.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 2420 set thread context of 2488	2420	ctfmon.exe	39
PID 2712 set thread context of 548	2712	ctfmon.exe	49
PID 2180 set thread context of 1868	2180	ctfmon.exe	52
PID 1040 set thread context of 2804	1040	ctfmon.exe	69
PID 1428 set thread context of 2196	1428	ctfmon.exe	70
PID 692 set thread context of 1916	692	ctfmon.exe	76
PID 2136 set thread context of 3016	2136	ctfmon.exe	97
PID 1972 set thread context of 3052	1972	ctfmon.exe	100
PID 2608 set thread context of 2944	2608	ctfmon.exe	104
PID 2536 set thread context of 2424	2536	ctfmon.exe	108
PID 2456 set thread context of 2316	2456	ctfmon.exe	135
PID 2704 set thread context of 1976	2704	ctfmon.exe	138
PID 1044 set thread context of 1528	1044	ctfmon.exe	144
PID 1888 set thread context of 1700	1888	ctfmon.exe	148
PID 2520 set thread context of 1740	2520	ctfmon.exe	160
PID 2260 set thread context of 2980	2260	ctfmon.exe	167
PID 2140 set thread context of 2944	2140	ctfmon.exe	182
PID 2160 set thread context of 1232	2160	ctfmon.exe	184
PID 2380 set thread context of 1956	2380	ctfmon.exe	203
PID 1528 set thread context of 2208	1528	ctfmon.exe	205
PID 1052 set thread context of 1096	1052	ctfmon.exe	221
PID 2360 set thread context of 2868	2360	ctfmon.exe	227
PID 1924 set thread context of 1548	1924	ctfmon.exe	228
PID 2124 set thread context of 2260	2124	ctfmon.exe	230
PID 1528 set thread context of 1904	1528	ctfmon.exe	244
PID 1648 set thread context of 3028	1648	ctfmon.exe	249
PID 2160 set thread context of 1528	2160	ctfmon.exe	264
PID 1312 set thread context of 2468	1312	ctfmon.exe	265
PID 884 set thread context of 2772	884	ctfmon.exe	271
PID 3024 set thread context of 1700	3024	ctfmon.exe	279
PID 3092 set thread context of 3124	3092	ctfmon.exe	285
PID 3312 set thread context of 3372	3312	ctfmon.exe	300
PID 3344 set thread context of 3404	3344	ctfmon.exe	301
PID 3564 set thread context of 3596	3564	ctfmon.exe	309
PID 3768 set thread context of 3844	3768	ctfmon.exe	324
PID 3792 set thread context of 3860	3792	ctfmon.exe	325
PID 4008 set thread context of 4044	4008	ctfmon.exe	331
PID 3148 set thread context of 3196	3148	ctfmon.exe	339
PID 3384 set thread context of 3436	3384	ctfmon.exe	346
PID 3608 set thread context of 3568	3608	ctfmon.exe	353
PID 3836 set thread context of 3888	3836	ctfmon.exe	361
PID 3596 set thread context of 4056	3596	ctfmon.exe	368
PID 2200 set thread context of 3324	2200	ctfmon.exe	376
PID 3652 set thread context of 3492	3652	ctfmon.exe	389
PID 3680 set thread context of 3876	3680	ctfmon.exe	390
PID 4008 set thread context of 3944	4008	ctfmon.exe	400
PID 3408 set thread context of 3900	3408	ctfmon.exe	414
PID 3884 set thread context of 4012	3884	ctfmon.exe	417
PID 3404 set thread context of 3380	3404	ctfmon.exe	435
PID 3960 set thread context of 3868	3960	ctfmon.exe	436
PID 3400 set thread context of 3900	3400	ctfmon.exe	440
PID 3380 set thread context of 4120	3380	ctfmon.exe	456
PID 4148 set thread context of 4268	4148	ctfmon.exe	460
PID 4304 set thread context of 4360	4304	ctfmon.exe	462
PID 4532 set thread context of 4572	4532	ctfmon.exe	472
PID 4684 set thread context of 4732	4684	ctfmon.exe	477
PID 4892 set thread context of 4932	4892	ctfmon.exe	488
PID 5068 set thread context of 3832	5068	ctfmon.exe	495
PID 4288 set thread context of 4328	4288	ctfmon.exe	508
PID 4244 set thread context of 4372	4244	ctfmon.exe	509
PID 4580 set thread context of 4624	4580	ctfmon.exe	517
PID 4776 set thread context of 4800	4776	ctfmon.exe	524
PID 4992 set thread context of 4736	4992	ctfmon.exe	532

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1980	afb2547a6a546a00e640e6ad45594247.exe
2420	ctfmon.exe
2712	ctfmon.exe
2180	ctfmon.exe
1040	ctfmon.exe
1428	ctfmon.exe
692	ctfmon.exe
2136	ctfmon.exe
1972	ctfmon.exe
2608	ctfmon.exe
2536	ctfmon.exe
2456	ctfmon.exe
2704	ctfmon.exe
1044	ctfmon.exe
1888	ctfmon.exe
2520	ctfmon.exe
2260	ctfmon.exe
2140	ctfmon.exe
2160	ctfmon.exe
2380	ctfmon.exe
1528	ctfmon.exe
1052	ctfmon.exe
2360	ctfmon.exe
1924	ctfmon.exe
2124	ctfmon.exe
1528	ctfmon.exe
1648	ctfmon.exe
2160	ctfmon.exe
1312	ctfmon.exe
884	ctfmon.exe
3024	ctfmon.exe
3092	ctfmon.exe
3312	ctfmon.exe
3344	ctfmon.exe
3564	ctfmon.exe
3768	ctfmon.exe
3792	ctfmon.exe
4008	ctfmon.exe
3148	ctfmon.exe
3384	ctfmon.exe
3608	ctfmon.exe
3836	ctfmon.exe
3596	ctfmon.exe
2200	ctfmon.exe
3652	ctfmon.exe
3680	ctfmon.exe
4008	ctfmon.exe
3408	ctfmon.exe
3884	ctfmon.exe
3404	ctfmon.exe
3960	ctfmon.exe
3400	ctfmon.exe
3380	ctfmon.exe
4148	ctfmon.exe
4304	ctfmon.exe
4532	ctfmon.exe
4684	ctfmon.exe
4892	ctfmon.exe
5068	ctfmon.exe
4288	ctfmon.exe
4244	ctfmon.exe
4580	ctfmon.exe
4776	ctfmon.exe
4992	ctfmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 1980 wrote to memory of 2920	1980	afb2547a6a546a00e640e6ad45594247.exe	28
PID 2920 wrote to memory of 2244	2920	afb2547a6a546a00e640e6ad45594247.exe	29
PID 2920 wrote to memory of 2244	2920	afb2547a6a546a00e640e6ad45594247.exe	29
PID 2920 wrote to memory of 2244	2920	afb2547a6a546a00e640e6ad45594247.exe	29
PID 2920 wrote to memory of 2244	2920	afb2547a6a546a00e640e6ad45594247.exe	29
PID 2920 wrote to memory of 2244	2920	afb2547a6a546a00e640e6ad45594247.exe	29
PID 2920 wrote to memory of 2512	2920	afb2547a6a546a00e640e6ad45594247.exe	30
PID 2920 wrote to memory of 2512	2920	afb2547a6a546a00e640e6ad45594247.exe	30
PID 2920 wrote to memory of 2512	2920	afb2547a6a546a00e640e6ad45594247.exe	30
PID 2920 wrote to memory of 2512	2920	afb2547a6a546a00e640e6ad45594247.exe	30
PID 2920 wrote to memory of 2512	2920	afb2547a6a546a00e640e6ad45594247.exe	30
PID 2920 wrote to memory of 2484	2920	afb2547a6a546a00e640e6ad45594247.exe	31
PID 2920 wrote to memory of 2484	2920	afb2547a6a546a00e640e6ad45594247.exe	31
PID 2920 wrote to memory of 2484	2920	afb2547a6a546a00e640e6ad45594247.exe	31
PID 2920 wrote to memory of 2484	2920	afb2547a6a546a00e640e6ad45594247.exe	31
PID 2920 wrote to memory of 2484	2920	afb2547a6a546a00e640e6ad45594247.exe	31
PID 2920 wrote to memory of 2132	2920	afb2547a6a546a00e640e6ad45594247.exe	32
PID 2920 wrote to memory of 2132	2920	afb2547a6a546a00e640e6ad45594247.exe	32
PID 2920 wrote to memory of 2132	2920	afb2547a6a546a00e640e6ad45594247.exe	32
PID 2920 wrote to memory of 2132	2920	afb2547a6a546a00e640e6ad45594247.exe	32
PID 2920 wrote to memory of 2132	2920	afb2547a6a546a00e640e6ad45594247.exe	32
PID 2920 wrote to memory of 2392	2920	afb2547a6a546a00e640e6ad45594247.exe	33
PID 2920 wrote to memory of 2392	2920	afb2547a6a546a00e640e6ad45594247.exe	33
PID 2920 wrote to memory of 2392	2920	afb2547a6a546a00e640e6ad45594247.exe	33
PID 2920 wrote to memory of 2392	2920	afb2547a6a546a00e640e6ad45594247.exe	33
PID 2920 wrote to memory of 2392	2920	afb2547a6a546a00e640e6ad45594247.exe	33
PID 2920 wrote to memory of 2700	2920	afb2547a6a546a00e640e6ad45594247.exe	34
PID 2920 wrote to memory of 2700	2920	afb2547a6a546a00e640e6ad45594247.exe	34
PID 2920 wrote to memory of 2700	2920	afb2547a6a546a00e640e6ad45594247.exe	34
PID 2920 wrote to memory of 2700	2920	afb2547a6a546a00e640e6ad45594247.exe	34
PID 2920 wrote to memory of 2700	2920	afb2547a6a546a00e640e6ad45594247.exe	34
PID 2920 wrote to memory of 2584	2920	afb2547a6a546a00e640e6ad45594247.exe	35
PID 2920 wrote to memory of 2584	2920	afb2547a6a546a00e640e6ad45594247.exe	35
PID 2920 wrote to memory of 2584	2920	afb2547a6a546a00e640e6ad45594247.exe	35
PID 2920 wrote to memory of 2584	2920	afb2547a6a546a00e640e6ad45594247.exe	35
PID 2920 wrote to memory of 2584	2920	afb2547a6a546a00e640e6ad45594247.exe	35
PID 2920 wrote to memory of 2844	2920	afb2547a6a546a00e640e6ad45594247.exe	36
PID 2920 wrote to memory of 2844	2920	afb2547a6a546a00e640e6ad45594247.exe	36
PID 2920 wrote to memory of 2844	2920	afb2547a6a546a00e640e6ad45594247.exe	36
PID 2920 wrote to memory of 2844	2920	afb2547a6a546a00e640e6ad45594247.exe	36
PID 2920 wrote to memory of 2844	2920	afb2547a6a546a00e640e6ad45594247.exe	36
PID 2920 wrote to memory of 2504	2920	afb2547a6a546a00e640e6ad45594247.exe	37
PID 2920 wrote to memory of 2504	2920	afb2547a6a546a00e640e6ad45594247.exe	37
PID 2920 wrote to memory of 2504	2920	afb2547a6a546a00e640e6ad45594247.exe	37
PID 2920 wrote to memory of 2504	2920	afb2547a6a546a00e640e6ad45594247.exe	37
PID 2920 wrote to memory of 2420	2920	afb2547a6a546a00e640e6ad45594247.exe	38
PID 2920 wrote to memory of 2420	2920	afb2547a6a546a00e640e6ad45594247.exe	38
PID 2920 wrote to memory of 2420	2920	afb2547a6a546a00e640e6ad45594247.exe	38
PID 2920 wrote to memory of 2420	2920	afb2547a6a546a00e640e6ad45594247.exe	38
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39
PID 2420 wrote to memory of 2488	2420	ctfmon.exe	39

C:\Users\Admin\AppData\Local\Temp\afb2547a6a546a00e640e6ad45594247.exe
"C:\Users\Admin\AppData\Local\Temp\afb2547a6a546a00e640e6ad45594247.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\afb2547a6a546a00e640e6ad45594247.exe
  "C:\Users\Admin\AppData\Local\Temp\afb2547a6a546a00e640e6ad45594247.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Loads dropped DLL
    - Adds Run key to start application
    PID:2244
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        
        PID:548
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2168
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1016
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2292
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2676
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1620
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2280
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1652
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:2980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:996
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2804
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1084
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1416
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1736
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:744
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2052
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1636
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2328
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1928
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2488
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1100
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3016
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2472
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2568
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2756
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1380
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1600
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1616
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1804
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2180
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:1976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1872
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2316
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2156
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1740
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2432
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2608
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2648
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2312
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2988
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1144
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2064
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:828
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:1232
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1232
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:2104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:2796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3092
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        15⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        17⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        18⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        19⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:4044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:2772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        20⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3384
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        21⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:1028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        22⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3836
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        23⤵
        Drops file in System32 directory
        
        PID:3888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        24⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        25⤵
        Modifies Installed Components in the registry
        
        PID:3324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:3936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:4036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        26⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        27⤵
        Modifies Installed Components in the registry
        Drops file in System32 directory
        
        PID:3944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:4056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        28⤵
        
        PID:3680
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2944
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1044
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2912
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1888
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1684
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1976
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2932
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2372
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2976
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:1612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:2140
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1956
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:932
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:544
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1552
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2376
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2764
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2804
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1760
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        
        PID:1548
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1096
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1784
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1904
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:796
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2124
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1624
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1868
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2456
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1136
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1124
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1924
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        
        PID:2468
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1528
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:560
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1516
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1700
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2552
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3060
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3164
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3212
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3232
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3248
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3276
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3292
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3312
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3792
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3996
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3344
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3404
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3528
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3552
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3768
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        
        PID:3844
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3196
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3328
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3356
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3424
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3608
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3568
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3376
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3804
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3824
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4056
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3108
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3184
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1048
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3448
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3388
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3340
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3396
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3620
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3652
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4016
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3680
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3876
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4024
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4072
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3888
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3024
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3464
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3160
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3640
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3432
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3884
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        
        PID:4012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:2572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3400
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        Adds Run key to start application
        
        PID:3900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        10⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        11⤵
        Loads dropped DLL
        
        PID:4360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\system32\InstallDir\ctfmon.exe"
        12⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4684
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        13⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        
        PID:4732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:4920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        14⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        14⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5068
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        15⤵
        Drops file in System32 directory
        
        PID:3832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4232
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        17⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        18⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        18⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        19⤵
        
        PID:4736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:3408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        20⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        20⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        21⤵
        Adds Run key to start application
        
        PID:2868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:5080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:5108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        22⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        22⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        23⤵
        Modifies Installed Components in the registry
        Drops file in System32 directory
        
        PID:4800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:1532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        24⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        24⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        25⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:4452
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:4944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:4424
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3408
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3900
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3476
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4068
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3316
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3172
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3508
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3852
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3924
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3568
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4380
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3380
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2164
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:3380
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:4120
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4236
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4572
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4660
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4708
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4820
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4840
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4860
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4892
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4932
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5012
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5032
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5092
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4156
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4184
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4200
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3380
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4244
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        
        PID:4372
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4288
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4328
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4416
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4552
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4592
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4776
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        
        PID:4800
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4948
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4964
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5004
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4104
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5068
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5088
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:3404
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4292
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Modifies Installed Components in the registry
        Drops file in System32 directory
        
        PID:4428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:5100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Drops file in System32 directory
        
        PID:4308
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:5072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:3900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4164
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        10⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        10⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        11⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:4784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        12⤵
        
        PID:3264
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      PID:3900
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:4120
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4116
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4652
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4696
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4768
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4776
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4616
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5076
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5104
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        
        PID:4256
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      PID:4828
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Drops file in System32 directory
        
        PID:4936
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4604
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      PID:4588
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4724
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4152
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4932
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      PID:4692
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Drops file in System32 directory
        
        PID:4588
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4124
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:4728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2512
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2484
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2132
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2392
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2700
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2584
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2844
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
    "C:\Windows\system32\InstallDir\ctfmon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      PID:2488
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1592
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1768
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:588
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:268
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:768
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2716
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2732
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctfmon.exe

Path C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
Size 256KB
SHA256 153d0e90f04bdbe79072ed1d07b9c25e14587803604415eea12d4174e382e877
MD5 e27c399575be136965ead597ae93a39a
SHA1 d2dfb774efbe64c40c9f9f90e0a41d85c90da729
SHA512 bffaf28adf9ab020af41d585e2eafbb0d3825943018f63ca6eb49d3b37a6e30f79d05b12411f8ae6d0679e42801b1f96427944aad36a951627087b65f520a28b
SSDEEP 3072:PrMUbMvKPFqJHOULc5kAVerPSfa+S1b7ziXFFJyiyO9BeBg5LfhVGjkVBw/TMGZa:j8a/S1OzJ7DDfhVGGIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

88603cb2913a7df3fbd16b5f958e6447_0f07e186-1bdc-490d-8c6e-7c4aeae2b85a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2461186416-2307104501-1787948496-1000\88603cb2913a7df3fbd16b5f958e6447_0f07e186-1bdc-490d-8c6e-7c4aeae2b85a
Size 51B
SHA256 374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
MD5 5fc2ac2a310f49c14d195230b91a8885
SHA1 90855cc11136ba31758fe33b5cf9571f9a104879
SHA512 ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3
MD5 SHA1 SHA512

Submit Download

uDnxVfoB.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uDnxVfoB.cfg
Size 1KB
SHA256 8478d000b28846e4b4e58fdb8e98cdef8789d51affffb1d9a82a985e0f5b971b
MD5 a78ff8e299c0b912fec1256945f3a542
SHA1 1cdd0ebbec47dc477d9553b59b7fa256ba723423
SHA512 2c8cd1a96f4193a2fba2d267b6f560983d3636886d2083f91d2e3997426fcb4bec0dce1863d4165cc41f4b11becf3ae5ad985a00fa4f05e39eb009d65cc1d022
MD5 SHA1 SHA512

Submit Download

ctfmon.exe

Path C:\Windows\SysWOW64\InstallDir\ctfmon.exe
Size 351KB
SHA256 799bc643cfd5b436e6226d5c42e3bef2cae2a4dcd5839924acfcd10fd403036b
MD5 afb2547a6a546a00e640e6ad45594247
SHA1 fa5bde5996e5108a45d3d5a22d9c17acdad08264
SHA512 8abfbb256d8b78bdb4e2046996c8a589062e416cd32935642bde463acbe341e0582ded3dffb9fe736875ea62bcb1f42e1996156e1af7cbea36d2bebf8047115c
SSDEEP 3072:PrMUbMvKPFqJHOULc5kAVerPSfa+S1b7ziXFFJyiyO9BeBg5LfhVGjkVBw/TMGZT:j8a/S1OzJ7DDfhVGGIzxpXkIdZr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctfmon.exe

Path \Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
Size 320KB
SHA256 1d911004e4648846971c58eaf2c2ccd69295ebca63c649601de2add73f0714ed
MD5 06659bfbace8f8ee9de5a918f6c8aec4
SHA1 9f1c92815fc78adf31b6bbf5b4115e3aaa099a1c
SHA512 d2905e8648ae1afd1a0ea66d9db5c130251a513461271f2b2bea60fe43008c3c472ac4493340860e61652d5920c9217c29cfd387457776039a816e3169469e8a
SSDEEP 3072:PrMUbMvKPFqJHOULc5kAVerPSfa+S1b7ziXFFJyiyO9BeBg5LfhVGjkVBw/TMGZn:j8a/S1OzJ7DDfhVGGIzxpXkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-75-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/548-114-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/548-118-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/692-157-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/692-169-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1040-112-0x00000000002C0000-0x00000000002C2000-memory.dmp

Download

memory/1040-137-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1040-115-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/1040-113-0x00000000002D0000-0x00000000002D2000-memory.dmp

Download

memory/1044-308-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

memory/1044-326-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1428-146-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1428-123-0x0000000000270000-0x0000000000272000-memory.dmp

Download

memory/1428-131-0x0000000001D00000-0x0000000001D01000-memory.dmp

Download

memory/1700-339-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1868-152-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1868-147-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1888-340-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1888-325-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/1916-168-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1916-223-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1916-219-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1972-218-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1972-196-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1976-299-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1980-18-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1980-0-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1980-5-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1980-4-0x0000000000270000-0x0000000000272000-memory.dmp

Download

memory/1980-3-0x0000000000260000-0x0000000000262000-memory.dmp

Download

memory/2136-178-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2136-200-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2180-103-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2180-92-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/2180-91-0x00000000002B0000-0x00000000002B2000-memory.dmp

Download

memory/2180-90-0x00000000002A0000-0x00000000002A2000-memory.dmp

Download

memory/2196-195-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2196-206-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2196-148-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2244-57-0x0000000000470000-0x00000000004C9000-memory.dmp

Download

memory/2244-26-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2316-282-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2316-303-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2420-51-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-38-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/2420-34-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2420-37-0x0000000000280000-0x0000000000282000-memory.dmp

Download

memory/2424-253-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2424-298-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2424-311-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2456-263-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/2456-285-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2488-50-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2488-87-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2536-233-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/2536-252-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2608-238-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2608-216-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2704-278-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

memory/2704-296-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2712-76-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2712-62-0x0000000000320000-0x0000000000322000-memory.dmp

Download

memory/2712-63-0x0000000000330000-0x0000000000332000-memory.dmp

Download

memory/2712-64-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/2804-179-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-15-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-31-0x0000000002FB0000-0x0000000003009000-memory.dmp

Download

memory/2920-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-17-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-9-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-33-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2920-16-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-8-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2920-13-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2944-281-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/2944-302-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3016-197-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3016-251-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3016-265-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3052-288-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3052-258-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads