xtremerat | 149ce45bff7c375cd730b676804c3d25b9c37c4b0f4011a04837a0f0d62f8d43

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Size

118KB
MD5

baa4577807099d5ef70c602515058c68
SHA1

a54569a382890354c833c47ccc211636e3724882
SHA256

149ce45bff7c375cd730b676804c3d25b9c37c4b0f4011a04837a0f0d62f8d43
SHA512

098f826edfb37a5b7ffc9d0010d687f099265ea287de315a5e9a41dff36d9a597550d04042af4991a84efae9c8bc9eb208255d8065bab63e0401c9b003a08abb
SSDEEP

1536:jF1Exu/SqzvEkjRHGaF1v50Aa1rteaVxR76CT13j8E1cQ1CwI510ZaNzizO9Na1v:jFexuznjTzs1BvZx3j/P5S6Za8zIlG

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/4996-8-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4996-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4872-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/4996-19-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1544-27-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1544-28-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral2/memory/1544-102-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32H6DBA3-1FJU-S810-8543-7Y8T6IARE2A6}\StubPath = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe restart"	ctfmon.exe

Checks computer location settings 2 TTPs 55 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ctfmon.exe

Executes dropped EXE 64 IoCs

pid	Process
4432	ctfmon.exe
1544	ctfmon.exe
5072	ctfmon.exe
1480	ctfmon.exe
4388	ctfmon.exe
5084	ctfmon.exe
1548	ctfmon.exe
1872	ctfmon.exe
636	ctfmon.exe
840	ctfmon.exe
1644	ctfmon.exe
1220	ctfmon.exe
3460	ctfmon.exe
4144	ctfmon.exe
676	ctfmon.exe
4352	ctfmon.exe
1556	ctfmon.exe
368	ctfmon.exe
5048	ctfmon.exe
4864	ctfmon.exe
3956	ctfmon.exe
1316	ctfmon.exe
4704	ctfmon.exe
2152	ctfmon.exe
1352	ctfmon.exe
4660	ctfmon.exe
2840	ctfmon.exe
1548	ctfmon.exe
1204	ctfmon.exe
5084	ctfmon.exe
4452	ctfmon.exe
3864	ctfmon.exe
3472	ctfmon.exe
3888	ctfmon.exe
1344	ctfmon.exe
3984	ctfmon.exe
628	ctfmon.exe
2428	ctfmon.exe
3636	ctfmon.exe
952	ctfmon.exe
3144	ctfmon.exe
4808	ctfmon.exe
2776	ctfmon.exe
4388	ctfmon.exe
4304	ctfmon.exe
4428	ctfmon.exe
1344	ctfmon.exe
3116	ctfmon.exe
3892	ctfmon.exe
4264	ctfmon.exe
1064	ctfmon.exe
2776	ctfmon.exe
3988	ctfmon.exe
4736	ctfmon.exe
4508	ctfmon.exe
688	ctfmon.exe
4420	ctfmon.exe
752	ctfmon.exe
4508	ctfmon.exe
3464	ctfmon.exe
5216	ctfmon.exe
5256	ctfmon.exe
5280	ctfmon.exe
5328	ctfmon.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4996-5-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4996-7-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4996-8-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4996-9-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4872-16-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4996-19-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1544-26-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1544-27-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1544-28-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1544-102-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\system32\\InstallDir\\ctfmon.exe"	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Ctfmon = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\ctfmon.exe"	ctfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\InstallDir\\ctfmon.exe"	ctfmon.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe
File created	C:\Windows\SysWOW64\InstallDir\ctfmon.exe	ctfmon.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 4432 set thread context of 1544	4432	ctfmon.exe	105
PID 5072 set thread context of 1480	5072	ctfmon.exe	118
PID 4388 set thread context of 5084	4388	ctfmon.exe	121
PID 1548 set thread context of 1872	1548	ctfmon.exe	130
PID 636 set thread context of 840	636	ctfmon.exe	134
PID 1644 set thread context of 1220	1644	ctfmon.exe	143
PID 3460 set thread context of 4144	3460	ctfmon.exe	147
PID 676 set thread context of 4352	676	ctfmon.exe	156
PID 1556 set thread context of 368	1556	ctfmon.exe	160
PID 5048 set thread context of 4864	5048	ctfmon.exe	170
PID 3956 set thread context of 1316	3956	ctfmon.exe	174
PID 4704 set thread context of 1352	4704	ctfmon.exe	193
PID 2152 set thread context of 4660	2152	ctfmon.exe	194
PID 1548 set thread context of 1204	1548	ctfmon.exe	205
PID 2840 set thread context of 5084	2840	ctfmon.exe	206
PID 4452 set thread context of 3864	4452	ctfmon.exe	216
PID 3472 set thread context of 3888	3472	ctfmon.exe	219
PID 1344 set thread context of 628	1344	ctfmon.exe	236
PID 3984 set thread context of 2428	3984	ctfmon.exe	239
PID 3636 set thread context of 952	3636	ctfmon.exe	244
PID 3144 set thread context of 2776	3144	ctfmon.exe	265
PID 4808 set thread context of 4304	4808	ctfmon.exe	268
PID 4388 set thread context of 4428	4388	ctfmon.exe	270
PID 1344 set thread context of 3116	1344	ctfmon.exe	276
PID 3892 set thread context of 1064	3892	ctfmon.exe	292
PID 4264 set thread context of 2776	4264	ctfmon.exe	293
PID 3988 set thread context of 4736	3988	ctfmon.exe	298
PID 4508 set thread context of 688	4508	ctfmon.exe	312
PID 4420 set thread context of 752	4420	ctfmon.exe	317
PID 4508 set thread context of 3464	4508	ctfmon.exe	323
PID 5216 set thread context of 5280	5216	ctfmon.exe	345
PID 5256 set thread context of 5376	5256	ctfmon.exe	348
PID 5328 set thread context of 5404	5328	ctfmon.exe	349
PID 5532 set thread context of 5564	5532	ctfmon.exe	356
PID 5840 set thread context of 5912	5840	ctfmon.exe	384
PID 5888 set thread context of 5964	5888	ctfmon.exe	386
PID 5992 set thread context of 6072	5992	ctfmon.exe	389
PID 5192 set thread context of 5196	5192	ctfmon.exe	394
PID 5548 set thread context of 5588	5548	ctfmon.exe	416
PID 5620 set thread context of 5644	5620	ctfmon.exe	419
PID 5376 set thread context of 5972	5376	ctfmon.exe	425
PID 4148 set thread context of 2344	4148	ctfmon.exe	445
PID 6028 set thread context of 5616	6028	ctfmon.exe	449
PID 4044 set thread context of 5824	4044	ctfmon.exe	452
PID 5472 set thread context of 5848	5472	ctfmon.exe	458
PID 3924 set thread context of 2812	3924	ctfmon.exe	478
PID 5944 set thread context of 3932	5944	ctfmon.exe	481
PID 5820 set thread context of 5480	5820	ctfmon.exe	489
PID 4440 set thread context of 1520	4440	ctfmon.exe	502
PID 5920 set thread context of 5820	5920	ctfmon.exe	507
PID 4112 set thread context of 6168	4112	ctfmon.exe	512
PID 6828 set thread context of 6868	6828	ctfmon.exe	535
PID 7048 set thread context of 7104	7048	ctfmon.exe	544
PID 7076 set thread context of 7132	7076	ctfmon.exe	545
PID 6468 set thread context of 6408	6468	ctfmon.exe	561
PID 6844 set thread context of 6904	6844	ctfmon.exe	565
PID 7088 set thread context of 7036	7088	ctfmon.exe	581
PID 7072 set thread context of 7136	7072	ctfmon.exe	584
PID 6224 set thread context of 6548	6224	ctfmon.exe	587
PID 6516 set thread context of 5780	6516	ctfmon.exe	611
PID 6408 set thread context of 7072	6408	ctfmon.exe	613
PID 7088 set thread context of 6836	7088	ctfmon.exe	615
PID 6592 set thread context of 6576	6592	ctfmon.exe	641

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ctfmon.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
4432	ctfmon.exe
5072	ctfmon.exe
4388	ctfmon.exe
1548	ctfmon.exe
636	ctfmon.exe
1644	ctfmon.exe
3460	ctfmon.exe
676	ctfmon.exe
1556	ctfmon.exe
5048	ctfmon.exe
3956	ctfmon.exe
4704	ctfmon.exe
2152	ctfmon.exe
2840	ctfmon.exe
1548	ctfmon.exe
4452	ctfmon.exe
3472	ctfmon.exe
1344	ctfmon.exe
3984	ctfmon.exe
3636	ctfmon.exe
3144	ctfmon.exe
4808	ctfmon.exe
4388	ctfmon.exe
1344	ctfmon.exe
3892	ctfmon.exe
4264	ctfmon.exe
3988	ctfmon.exe
4508	ctfmon.exe
4420	ctfmon.exe
4508	ctfmon.exe
5216	ctfmon.exe
5256	ctfmon.exe
5328	ctfmon.exe
5532	ctfmon.exe
5840	ctfmon.exe
5888	ctfmon.exe
5992	ctfmon.exe
5192	ctfmon.exe
5548	ctfmon.exe
5620	ctfmon.exe
5376	ctfmon.exe
4148	ctfmon.exe
6028	ctfmon.exe
4044	ctfmon.exe
5472	ctfmon.exe
3924	ctfmon.exe
5944	ctfmon.exe
5820	ctfmon.exe
4440	ctfmon.exe
5920	ctfmon.exe
4112	ctfmon.exe
6828	ctfmon.exe
7048	ctfmon.exe
7076	ctfmon.exe
6468	ctfmon.exe
6844	ctfmon.exe
7088	ctfmon.exe
7072	ctfmon.exe
6224	ctfmon.exe
6516	ctfmon.exe
6408	ctfmon.exe
7088	ctfmon.exe
6592	ctfmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 928 wrote to memory of 4996	928	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	86
PID 4996 wrote to memory of 4872	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	88
PID 4996 wrote to memory of 4872	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	88
PID 4996 wrote to memory of 4872	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	88
PID 4996 wrote to memory of 4872	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	88
PID 4996 wrote to memory of 3404	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	91
PID 4996 wrote to memory of 3404	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	91
PID 4996 wrote to memory of 3404	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	91
PID 4996 wrote to memory of 3484	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	92
PID 4996 wrote to memory of 3484	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	92
PID 4996 wrote to memory of 3484	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	92
PID 4996 wrote to memory of 4460	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	94
PID 4996 wrote to memory of 4460	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	94
PID 4996 wrote to memory of 4460	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	94
PID 4996 wrote to memory of 3368	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	97
PID 4996 wrote to memory of 3368	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	97
PID 4996 wrote to memory of 3368	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	97
PID 4996 wrote to memory of 4944	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	98
PID 4996 wrote to memory of 4944	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	98
PID 4996 wrote to memory of 4944	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	98
PID 4996 wrote to memory of 920	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	101
PID 4996 wrote to memory of 920	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	101
PID 4996 wrote to memory of 920	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	101
PID 4996 wrote to memory of 556	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	102
PID 4996 wrote to memory of 556	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	102
PID 4996 wrote to memory of 556	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	102
PID 4996 wrote to memory of 3880	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	103
PID 4996 wrote to memory of 3880	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	103
PID 4996 wrote to memory of 4432	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	104
PID 4996 wrote to memory of 4432	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	104
PID 4996 wrote to memory of 4432	4996	baa4577807099d5ef70c602515058c68_JaffaCakes118.exe	104
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 4432 wrote to memory of 1544	4432	ctfmon.exe	105
PID 1544 wrote to memory of 1444	1544	ctfmon.exe	106
PID 1544 wrote to memory of 1444	1544	ctfmon.exe	106
PID 1544 wrote to memory of 1444	1544	ctfmon.exe	106
PID 1544 wrote to memory of 8	1544	ctfmon.exe	108
PID 1544 wrote to memory of 8	1544	ctfmon.exe	108
PID 1544 wrote to memory of 8	1544	ctfmon.exe	108
PID 1544 wrote to memory of 2848	1544	ctfmon.exe	109
PID 1544 wrote to memory of 2848	1544	ctfmon.exe	109
PID 1544 wrote to memory of 2848	1544	ctfmon.exe	109
PID 1544 wrote to memory of 4976	1544	ctfmon.exe	110
PID 1544 wrote to memory of 4976	1544	ctfmon.exe	110
PID 1544 wrote to memory of 4976	1544	ctfmon.exe	110
PID 1544 wrote to memory of 1568	1544	ctfmon.exe	111
PID 1544 wrote to memory of 1568	1544	ctfmon.exe	111
PID 1544 wrote to memory of 1568	1544	ctfmon.exe	111
PID 1544 wrote to memory of 3416	1544	ctfmon.exe	112
PID 1544 wrote to memory of 3416	1544	ctfmon.exe	112
PID 1544 wrote to memory of 3416	1544	ctfmon.exe	112

C:\Users\Admin\AppData\Local\Temp\baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\baa4577807099d5ef70c602515058c68_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\baa4577807099d5ef70c602515058c68_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\baa4577807099d5ef70c602515058c68_JaffaCakes118.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies registry class
    PID:4872
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5072
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3204
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        
        PID:1872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1852
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1836
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:676
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2260
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5048
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4356
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:428
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        
        PID:5084
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        
        PID:4660
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3636
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5532
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        17⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        18⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5192
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        19⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        20⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5376
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        21⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:5404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:5968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        22⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5472
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        23⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        
        PID:5848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:3468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:5916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:5540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        24⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5820
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        25⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:5480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:4824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        26⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4112
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        27⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6944
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4452
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1016
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3144
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2412
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3984
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4772
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4808
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        
        PID:4304
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3508
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5216
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        
        PID:5280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        12⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5840
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:6040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        14⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5548
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        15⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        17⤵
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:6120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:6100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        18⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3924
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        19⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:3840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        20⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4440
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        21⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:1520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:5712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        22⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:6828
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        23⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        24⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:6468
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        25⤵
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:6596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:6752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:6768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:6668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:6680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:7064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        26⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7088
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        27⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        Modifies registry class
        
        PID:7036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:7076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:3924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:6840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        28⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6408
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        29⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:7080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:7020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        30⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6592
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        31⤵
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        33⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:7516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        34⤵
        
        PID:7580
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4264
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        
        PID:2776
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5208
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5256
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:5376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5888
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        
        PID:5964
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5328
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:5404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5880
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5992
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        
        PID:6072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5620
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        10⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:6028
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        12⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5944
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        13⤵
        Adds Run key to start application
        
        PID:3932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5956
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4044
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5388
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5920
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6936
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7076
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        
        PID:7132
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:7048
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6356
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6844
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        
        PID:6904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6224
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6676
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:7072
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6700
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:6516
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        10⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        12⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        
        PID:8008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:8156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        14⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        15⤵
        Checks computer location settings
        Adds Run key to start application
        
        PID:7696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:6436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        16⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        17⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:6076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:8132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:8184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:7196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:7488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:7472
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:7088
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7052
      - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        6⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        
        PID:6180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        8⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        9⤵
        
        PID:7668
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7088
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        
        PID:5780
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      PID:7880
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:7908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        
        PID:7644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7672
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7452
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:8180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:7532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:7724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:7632
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Drops file in System32 directory
      PID:4716
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7972
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\system32\InstallDir\ctfmon.exe"
      4⤵
      Drops file in System32 directory
      PID:7460
    - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
        
        "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        
        PID:7952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
    "C:\Windows\system32\InstallDir\ctfmon.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\SysWOW64\InstallDir\ctfmon.exe
      "C:\Windows\SysWOW64\InstallDir\ctfmon.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:8
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4388
      - C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        
        PID:840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3956
        
        C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\InstallDir\ctfmon.exe"
        14⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\88603cb2913a7df3fbd16b5f958e6447_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

Filesize
51B

MD5
5fc2ac2a310f49c14d195230b91a8885

SHA1
90855cc11136ba31758fe33b5cf9571f9a104879

SHA256
374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092

SHA512
ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uDnxVfoB.cfg

Filesize
1KB

MD5
a78ff8e299c0b912fec1256945f3a542

SHA1
1cdd0ebbec47dc477d9553b59b7fa256ba723423

SHA256
8478d000b28846e4b4e58fdb8e98cdef8789d51affffb1d9a82a985e0f5b971b

SHA512
2c8cd1a96f4193a2fba2d267b6f560983d3636886d2083f91d2e3997426fcb4bec0dce1863d4165cc41f4b11becf3ae5ad985a00fa4f05e39eb009d65cc1d022

Download Submit
C:\Windows\SysWOW64\InstallDir\ctfmon.exe

Filesize
118KB

MD5
baa4577807099d5ef70c602515058c68

SHA1
a54569a382890354c833c47ccc211636e3724882

SHA256
149ce45bff7c375cd730b676804c3d25b9c37c4b0f4011a04837a0f0d62f8d43

SHA512
098f826edfb37a5b7ffc9d0010d687f099265ea287de315a5e9a41dff36d9a597550d04042af4991a84efae9c8bc9eb208255d8065bab63e0401c9b003a08abb

Download Submit
memory/636-132-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/676-165-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/928-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/928-10-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1344-404-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1344-347-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1544-28-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1544-26-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1544-27-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1544-102-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1548-242-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1548-121-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1556-177-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1556-170-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1644-143-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2152-223-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2152-207-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2840-229-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2840-244-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3144-382-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3460-154-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3472-332-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3636-368-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3892-407-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3892-419-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3924-604-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3956-199-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3984-356-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3988-432-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4044-586-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4112-649-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4148-568-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4264-423-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4388-395-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4388-103-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4388-111-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4420-450-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4432-29-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4440-631-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4452-303-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4452-320-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4508-459-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4508-445-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4704-218-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4716-876-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4716-883-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4808-388-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4872-16-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4996-9-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4996-5-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4996-19-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4996-7-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4996-8-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5048-188-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5072-85-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5072-98-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5192-532-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5216-470-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5256-485-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5328-487-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5328-473-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5376-559-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5472-595-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5532-496-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5548-543-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5620-550-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5820-622-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5840-510-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5888-516-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5920-640-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5944-613-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5992-523-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6028-577-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6224-728-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6408-751-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6468-686-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6516-740-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6592-766-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6828-658-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6844-698-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6976-787-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7028-784-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7048-673-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7072-719-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7076-677-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7076-663-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7088-789-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7088-755-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7088-712-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7452-852-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7452-845-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7460-913-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7464-801-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7492-922-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7500-864-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7608-873-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7608-813-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7612-819-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7772-894-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7880-826-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7944-839-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7944-832-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/7948-901-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads