e00016ae3f99c81e04e916f5476fc1d965f5553572f4b7b81c6d7f1209f8f807

Analysis

max time kernel
147s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
Size

124KB
MD5

3a267cfdc8cb0a4126c439e028fc46b2
SHA1

7635d7ac8308155d259484461c9da243da18c6bd
SHA256

e00016ae3f99c81e04e916f5476fc1d965f5553572f4b7b81c6d7f1209f8f807
SHA512

1d2ae1a8a9e22ab5bbeda306faf5bb1fa29bf5704b57a19ee04fdac8173415d7449c7ac1cc2a719788c7cc5d183450624300e091bcf43a9cc45b0fe8298e470a
SSDEEP

768:/0xUM1fz0WPBTKLijLzwvxqbtAHG15hGzpAnvCZgWyrB8aywc+57Tyw0ewDteA4V:u5T6imGtFTR8BGgz6OiT6iX

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 46 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe

Adds Run key to start application 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "C:\\WINDOWS\\system32\\config\\winlogon.exe"	regedit.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\2.reg	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\3.reg	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\4.reg	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\5.reg	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\8.bat	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\1.reg	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regedit.exe

Modifies Internet Explorer start page 1 TTPs 46 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.jgysschool.com/jgys/student/gongzi.html"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command\ = "C:\\WINDOWS\\SysWow64\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command\ = "C:\\WINDOWS\\SysWow64\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command\ = "C:\\WINDOWS\\SysWow64\\config\\winlogon.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\ = "Logfiles"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command\ = "C:\\WINDOWS\\SysWow64\\config\\winlogon.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyApp"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyApp\shell\open\command	regedit.exe

Runs .reg file with regedit 64 IoCs

pid	Process
2504	regedit.exe
2852	regedit.exe
2208	regedit.exe
572	regedit.exe
956	regedit.exe
2576	regedit.exe
2760	regedit.exe
1700	regedit.exe
1732	regedit.exe
1136	regedit.exe
1996	regedit.exe
2216	regedit.exe
2892	regedit.exe
1972	regedit.exe
1752	regedit.exe
2888	regedit.exe
1580	regedit.exe
1716	regedit.exe
2260	regedit.exe
2828	regedit.exe
844	regedit.exe
584	regedit.exe
2184	regedit.exe
2396	regedit.exe
2836	regedit.exe
1128	regedit.exe
2680	regedit.exe
2120	regedit.exe
2880	regedit.exe
1764	regedit.exe
2144	regedit.exe
2748	regedit.exe
2088	regedit.exe
2780	regedit.exe
1552	regedit.exe
3012	regedit.exe
336	regedit.exe
1596	regedit.exe
1424	regedit.exe
1664	regedit.exe
2352	regedit.exe
1820	regedit.exe
1504	regedit.exe
2724	regedit.exe
2616	regedit.exe
1636	regedit.exe
2880	regedit.exe
1160	regedit.exe
548	regedit.exe
2320	regedit.exe
2712	regedit.exe
832	regedit.exe
2732	regedit.exe
1384	regedit.exe
1008	regedit.exe
740	regedit.exe
3032	regedit.exe
2784	regedit.exe
1576	regedit.exe
2740	regedit.exe
2088	regedit.exe
1136	regedit.exe
2252	regedit.exe
2832	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2720	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2720	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2720	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2720	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2980	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2980	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2980	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2980	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	31
PID 2256 wrote to memory of 832	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	33
PID 2256 wrote to memory of 832	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	33
PID 2256 wrote to memory of 832	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	33
PID 2256 wrote to memory of 832	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2888	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2888	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2888	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2888	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2908	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2908	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2908	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2908	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	35
PID 2256 wrote to memory of 3008	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	36
PID 2256 wrote to memory of 3008	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	36
PID 2256 wrote to memory of 3008	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	36
PID 2256 wrote to memory of 3008	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	36
PID 2256 wrote to memory of 2976	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	37
PID 2256 wrote to memory of 2976	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	37
PID 2256 wrote to memory of 2976	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	37
PID 2256 wrote to memory of 2976	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	37
PID 2256 wrote to memory of 2784	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	38
PID 2256 wrote to memory of 2784	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	38
PID 2256 wrote to memory of 2784	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	38
PID 2256 wrote to memory of 2784	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	38
PID 2256 wrote to memory of 2956	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	39
PID 2256 wrote to memory of 2956	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	39
PID 2256 wrote to memory of 2956	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	39
PID 2256 wrote to memory of 2956	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	39
PID 2256 wrote to memory of 2992	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	40
PID 2256 wrote to memory of 2992	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	40
PID 2256 wrote to memory of 2992	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	40
PID 2256 wrote to memory of 2992	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	40
PID 2256 wrote to memory of 2952	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	41
PID 2256 wrote to memory of 2952	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	41
PID 2256 wrote to memory of 2952	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	41
PID 2256 wrote to memory of 2952	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	41
PID 2256 wrote to memory of 3064	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	42
PID 2256 wrote to memory of 3064	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	42
PID 2256 wrote to memory of 3064	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	42
PID 2256 wrote to memory of 3064	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	42
PID 2256 wrote to memory of 2812	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	43
PID 2256 wrote to memory of 2812	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	43
PID 2256 wrote to memory of 2812	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	43
PID 2256 wrote to memory of 2812	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	43
PID 2256 wrote to memory of 2948	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	44
PID 2256 wrote to memory of 2948	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	44
PID 2256 wrote to memory of 2948	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	44
PID 2256 wrote to memory of 2948	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	44
PID 2256 wrote to memory of 2172	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	45
PID 2256 wrote to memory of 2172	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	45
PID 2256 wrote to memory of 2172	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	45
PID 2256 wrote to memory of 2172	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	45
PID 2256 wrote to memory of 1384	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	46
PID 2256 wrote to memory of 1384	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	46
PID 2256 wrote to memory of 1384	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	46
PID 2256 wrote to memory of 1384	2256	3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe	46

C:\Users\Admin\AppData\Local\Temp\3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a267cfdc8cb0a4126c439e028fc46b2_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\WINDOWS\system32\8.bat
  2⤵
  PID:2720
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2980
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:832
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:2888
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2908
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:3008
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2976
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2784
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2956
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2992
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2952
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:3064
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2812
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2172
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Runs .reg file with regedit
  PID:1384
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:1448
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2944
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2840
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2892
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  PID:2776
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2832
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2836
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2288
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2596
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2428
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2204
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2600
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2760
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2552
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:1160
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:736
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1636
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2200
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:1988
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:1136
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1576
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1424
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2828
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:1260
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  PID:1044
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2044
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2764
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2180
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:584
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:548
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Runs .reg file with regedit
  PID:336
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2088
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1820
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2876
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2252
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:3044
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2120
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2880
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1208
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:1764
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:1596
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1080
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:660
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:624
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2208
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2420
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2960
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  PID:2260
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:572
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2224
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2228
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2216
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2376
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:2236
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2640
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:1700
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1672
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2424
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1960
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:1588
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:1128
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2740
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1504
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:924
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1008
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2676
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2664
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:596
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2144
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1668
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2108
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1972
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1992
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:756
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1624
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2504
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2328
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2632
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2080
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:1664
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2568
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:1688
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1052
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1580
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:1732
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:844
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2680
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2344
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2748
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2124
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2072
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1752
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2320
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2392
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1428
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:792
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:564
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1376
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2352
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2624
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  PID:868
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1716
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1908
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:824
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:872
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:1552
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  PID:1644
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2712
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:3068
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:740
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2464
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2980
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:832
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2656
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2184
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2924
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:3016
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:3012
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2724
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2212
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:2784
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2956
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2992
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2952
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:3064
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2868
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3032
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2164
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2800
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:1448
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:3052
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2780
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2816
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:956
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:964
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:1492
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2856
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2900
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:2616
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2852
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2168
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:2576
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1928
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2756
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2304
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1532
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1160
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:736
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1636
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  PID:1988
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2092
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:1136
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1576
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:1424
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1568
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:1612
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1692
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1104
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:812
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:932
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2764
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2180
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:584
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:336
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2088
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1820
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2876
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:3044
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2120
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - Runs .reg file with regedit
  PID:2880
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:2372
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer start page
  PID:1792
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1996
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:1764
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1596
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:1080
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2436
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:2208
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2960
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Runs .reg file with regedit
  PID:2260
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2000
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2224
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2228
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:1640
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:2216
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2236
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2112
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:2396
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs .reg file with regedit
  PID:2732
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:1940
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:376
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:888
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - Modifies registry class
  PID:1132
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:532
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\2.reg
  2⤵
  - Adds Run key to start application
  PID:948
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\3.reg
  2⤵
  PID:2496
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\4.reg
  2⤵
  - Disables RegEdit via registry modification
  PID:2556
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\WINDOWS\system32\5.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1.reg

Filesize
557B

MD5
066019dffcca73a50173cece9ecda48e

SHA1
e235ac3df1591aba0c127bc33dce60e61deca6b0

SHA256
c90d7fd8caee732fdb95baf724ad03ab18a5f16f4cc7849ecff76544e311b941

SHA512
aeff739a01012dc1f0dcbe92aac3ad8a5eda05721dab2abe51b24fcdba23111de030da6379074906ccc4b6f1d448b27197d86596dadd109f1bf44a07e47ffa45

Download Submit
C:\Windows\SysWOW64\2.reg

Filesize
162B

MD5
67eb522f01ddf3540a1423d94bdca031

SHA1
5a70dfa47d9a7873f28d4fc1012536f023c35d1a

SHA256
2db7d61eb3af901cb76b221ab52c721139d84fc467c25daa6a5b91198208c849

SHA512
8d13094b1202f1b01ef0e4a16282e09e14fa28e8dfe7dec59dd7bbf8c03ab0313996f71f4446e8f4e0a1a42f59bae4e465eaf8434c536fec8a77c2e64910cec2

Download Submit
C:\Windows\SysWOW64\3.reg

Filesize
150B

MD5
c108d1477b9a9556017d3f082e9535fb

SHA1
0a6eabe5bf50bb111402b15c226511af118361df

SHA256
bd9e6ddbd2361c2bdb74f98c295146989e96d606f0fef5b2c91ec86b6c29f20b

SHA512
0d34c36d7ada05dcea4d74246ccf440011ff74c17a43eb8390fe6eb19cd8041f72e994cc64c3c33f92cc6c39e84c84359430fc34de678e6278f0493cfe9bca6f

Download Submit
C:\Windows\SysWOW64\4.reg

Filesize
160B

MD5
c6fbbff5fa1aca2a29088303fdb77053

SHA1
c50c4c767298a3342075eab37c9f96725e76bbe1

SHA256
0f2d8c9204c0d3cc12baae200dd81badbaf4e12d348596cb893d52779e9a697a

SHA512
48020c19de8c2f3d5016b55b2605481760ec209637b1300f192780d2ee6e037724bf5f622801811bdfeda3d35a366fb12064ae9823f8b0803341802d0cf3212f

Download Submit
C:\Windows\SysWOW64\5.reg

Filesize
427B

MD5
1a0ac885aa4c434f2ebfa6bfdf782819

SHA1
538fbc3c82db8468f4ec9bf8a3dedb0c13794431

SHA256
f7ad06cce6741d3dc6beb16b4dc6de9d443d52dcdcd1d4f7c2229d177c95989a

SHA512
efd2e15825393caaa7e61ac8687661203a69191a32fc28ce94019bcb44b0b96b3b50fdddd45a26d62a6603608ed12c5fcf28769796229adf317c5db7e84f1b0c

Download Submit
C:\Windows\SysWOW64\8.bat

Filesize
11KB

MD5
16b229fdb7eaf32fd45e65683e862286

SHA1
f5e06d185e409714fe8ab83cc4b10423ac630b09

SHA256
e66a3e0bf8d91aad7cfc1fc491222da4b8896748007d811c66d1ece60bd25be1

SHA512
aaee20aa488c6a7ba9f271b1dd7644acc4d7500dc93427e0c196ca3f77773ef73d1cb248b2a77ed6f31626906f8a846459fb878c278a9af9ebb192e245cd7170

Download Submit
memory/872-21-0x00000000770C0000-0x00000000771BA000-memory.dmp

Filesize
1000KB

Download
memory/872-20-0x00000000771C0000-0x00000000772DF000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads