Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 21:04
Static task
static1
Behavioral task
behavioral1
Sample
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
Resource
win10v2004-20240412-en
General
-
Target
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
-
Size
242KB
-
MD5
ed931c81cd2ee363652b63ff6aebb6f0
-
SHA1
dc7756f0987d4b6f09dbd4b52fab4de03b7b880f
-
SHA256
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95
-
SHA512
3f400615c122ddb7826571bb5864f72841a07f86cf7274f55b115585b1ea35fb442cbaca2f676ff7d05a66d9d20fee9649b0eebf0e5db7f017779e8a37be765c
-
SSDEEP
6144:bZqwyNZcdrNHFCAZwd4TyQOI5JgpcvqNplcdaY5vK:bZqwykxFCAVT0Iw5pZyK
Malware Config
Signatures
-
Detect XtremeRAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/1740-52-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/1740-53-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/1740-56-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/1740-58-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/1740-72-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/3016-117-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/3144-165-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/3240-291-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/3500-342-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/4720-559-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral2/memory/1016-634-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 56 IoCs
Processes:
java.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe -
Checks computer location settings 2 TTPs 27 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
java.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation java.exe -
Drops startup file 2 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe -
Executes dropped EXE 54 IoCs
Processes:
java.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exepid process 1560 java.exe 3016 java.exe 3140 java.exe 3144 java.exe 2384 java.exe 3824 java.exe 4468 java.exe 3240 java.exe 3972 java.exe 3500 java.exe 2076 java.exe 2288 java.exe 4928 java.exe 1608 java.exe 396 java.exe 1500 java.exe 4024 java.exe 2464 java.exe 552 java.exe 4720 java.exe 636 java.exe 4300 java.exe 3588 java.exe 1016 java.exe 4764 java.exe 4928 java.exe 4340 java.exe 3892 java.exe 1940 java.exe 220 java.exe 3472 java.exe 3892 java.exe 2192 java.exe 4056 java.exe 1152 java.exe 3448 java.exe 3472 java.exe 2656 java.exe 4256 java.exe 1668 java.exe 4160 java.exe 232 java.exe 3824 java.exe 2872 java.exe 3004 java.exe 5272 java.exe 5436 java.exe 5604 java.exe 5756 java.exe 5816 java.exe 5972 java.exe 6108 java.exe 5464 java.exe 5556 java.exe -
Adds Run key to start application 2 TTPs 56 IoCs
Processes:
java.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe -
Suspicious use of SetThreadContext 28 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exedescription pid process target process PID 4320 set thread context of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 1560 set thread context of 3016 1560 java.exe java.exe PID 3140 set thread context of 3144 3140 java.exe java.exe PID 2384 set thread context of 3824 2384 java.exe java.exe PID 4468 set thread context of 3240 4468 java.exe java.exe PID 3972 set thread context of 3500 3972 java.exe java.exe PID 2076 set thread context of 2288 2076 java.exe java.exe PID 4928 set thread context of 1608 4928 java.exe java.exe PID 396 set thread context of 1500 396 java.exe java.exe PID 4024 set thread context of 2464 4024 java.exe java.exe PID 552 set thread context of 4720 552 java.exe java.exe PID 636 set thread context of 4300 636 java.exe java.exe PID 3588 set thread context of 1016 3588 java.exe java.exe PID 4764 set thread context of 4928 4764 java.exe java.exe PID 4340 set thread context of 3892 4340 java.exe java.exe PID 1940 set thread context of 220 1940 java.exe java.exe PID 3472 set thread context of 3892 3472 java.exe java.exe PID 2192 set thread context of 4056 2192 java.exe java.exe PID 1152 set thread context of 3448 1152 java.exe java.exe PID 3472 set thread context of 2656 3472 java.exe java.exe PID 4256 set thread context of 1668 4256 java.exe java.exe PID 4160 set thread context of 232 4160 java.exe java.exe PID 3824 set thread context of 2872 3824 java.exe java.exe PID 3004 set thread context of 5272 3004 java.exe java.exe PID 5436 set thread context of 5604 5436 java.exe java.exe PID 5756 set thread context of 5816 5756 java.exe java.exe PID 5972 set thread context of 6108 5972 java.exe java.exe PID 5464 set thread context of 5556 5464 java.exe java.exe -
Drops file in Windows directory 2 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exedescription ioc process File opened for modification C:\Windows\java\java.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe File created C:\Windows\java\java.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
java.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exepid process 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 1560 java.exe 3140 java.exe 2384 java.exe 4468 java.exe 3972 java.exe 2076 java.exe 4928 java.exe 396 java.exe 4024 java.exe 552 java.exe 636 java.exe 3588 java.exe 4764 java.exe 4340 java.exe 1940 java.exe 3472 java.exe 2192 java.exe 1152 java.exe 3472 java.exe 4256 java.exe 4160 java.exe 3824 java.exe 3004 java.exe 5436 java.exe 5756 java.exe 5972 java.exe 5464 java.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exedescription pid process target process PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 4320 wrote to memory of 1740 4320 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 1740 wrote to memory of 1476 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 1476 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3096 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 1740 wrote to memory of 3096 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 1740 wrote to memory of 3096 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 1740 wrote to memory of 1476 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3580 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3580 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3580 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 2748 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 2748 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 2748 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 4500 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 4500 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 4500 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 1524 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 1524 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 1524 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3128 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3128 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3128 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3804 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3804 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3804 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3304 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 3304 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe msedge.exe PID 1740 wrote to memory of 1560 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 1740 wrote to memory of 1560 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 1740 wrote to memory of 1560 1740 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 1560 wrote to memory of 3016 1560 java.exe java.exe PID 3016 wrote to memory of 5016 3016 java.exe msedge.exe PID 3016 wrote to memory of 5016 3016 java.exe msedge.exe PID 3016 wrote to memory of 5016 3016 java.exe msedge.exe PID 3016 wrote to memory of 4200 3016 java.exe msedge.exe PID 3016 wrote to memory of 4200 3016 java.exe msedge.exe PID 3016 wrote to memory of 4200 3016 java.exe msedge.exe PID 3016 wrote to memory of 4296 3016 java.exe msedge.exe PID 3016 wrote to memory of 4296 3016 java.exe msedge.exe PID 3016 wrote to memory of 4296 3016 java.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe"C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exeC:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe2⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\java\java.exeC:\Windows\java\java.exe4⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe8⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe10⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe12⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe14⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe16⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe18⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe20⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe22⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe24⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe26⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe28⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe30⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe32⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe34⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe36⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe38⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe40⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe42⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe44⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe46⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe48⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe50⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe52⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe54⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe56⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfgFilesize
1KB
MD52eb7f132efb9924b7174eb5458df74f5
SHA1bde3f2f5eedc30401138575a67a74c0c7fd0163c
SHA256d867c821917aabe27e2f116e7460b65b5404e7a671bce56f75f2f54dd9561a82
SHA5120fb542eadc164b1c6f11d826d065d86bccb69171db3322084c5bd4803e24697edba0f477d027054284e0110d5ee684d51f1b0e4c95dcfd5b35cefcb5bdedbca9
-
C:\Windows\java\java.exeFilesize
242KB
MD5ed931c81cd2ee363652b63ff6aebb6f0
SHA1dc7756f0987d4b6f09dbd4b52fab4de03b7b880f
SHA2563b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95
SHA5123f400615c122ddb7826571bb5864f72841a07f86cf7274f55b115585b1ea35fb442cbaca2f676ff7d05a66d9d20fee9649b0eebf0e5db7f017779e8a37be765c
-
memory/396-473-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/552-560-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/636-602-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1016-634-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1560-80-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-74-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-73-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-78-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-76-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-79-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-81-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-82-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-83-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-84-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-119-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1560-85-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1560-86-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1740-53-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1740-56-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1740-58-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1740-52-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1740-72-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/1940-754-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2076-396-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2384-213-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3016-117-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/3140-166-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3144-165-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/3240-291-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/3500-342-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/3588-637-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3972-341-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4024-518-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4320-24-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-26-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-39-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-40-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-41-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-42-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-43-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-44-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-45-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-46-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-47-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-48-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-49-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-50-0x0000000002110000-0x0000000002113000-memory.dmpFilesize
12KB
-
memory/4320-51-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/4320-37-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-36-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-35-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-57-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4320-34-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-33-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-32-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-31-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-30-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-29-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-28-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-27-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-38-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-25-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-0-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4320-23-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-22-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-21-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-20-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-19-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-18-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-17-0x00000000022E0000-0x00000000022FB000-memory.dmpFilesize
108KB
-
memory/4320-15-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-14-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-13-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-12-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-1-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-11-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-10-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-9-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-2-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-8-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-6-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-4-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-7-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4320-5-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4340-715-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4468-292-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4720-559-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/4764-669-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4928-425-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB