Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
34af88ef4a6...18.exe
windows7-x64
104af88ef4a6...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/Nusupumewu.dll
windows7-x64
3$TEMP/Nusupumewu.dll
windows10-2004-x64
3$TEMP/Penamogodiy.dll
windows7-x64
3$TEMP/Penamogodiy.dll
windows10-2004-x64
3$TEMP/Zomafoyi.dll
windows7-x64
3$TEMP/Zomafoyi.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$TEMP/Nusupumewu.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$TEMP/Nusupumewu.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$TEMP/Penamogodiy.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$TEMP/Penamogodiy.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$TEMP/Zomafoyi.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$TEMP/Zomafoyi.dll
Resource
win10v2004-20241007-en
General
-
Target
4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
-
Size
457KB
-
MD5
4af88ef4a6ceca1e24db838015deac2b
-
SHA1
b0a62cf9928e8d6a424b4d2c962feb127ae0ab5a
-
SHA256
3b502edbf977c5a629a89dca66683d9f3c79588b47dcf4177fc492fe01187c43
-
SHA512
8ea3197dc05832b8be3de4b4900af76d989bbbc7645f81966fecfafba3d6acddd79b649037c7169ba4f702d0fdb14d7ec6cd5c460e3b6c5e70dabf64bbe39d3b
-
SSDEEP
12288:ptCM7BwSFbDUbQqX4l/DfTLZI0l+8Euui04MQp:pNbiX4ljACPfdp
Malware Config
Signatures
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Server.exe -
Executes dropped EXE 49 IoCs
pid Process 1692 Server.exe 1336 Server.exe 1000 Server.exe 1156 Server.exe 524 Server.exe 4304 Server.exe 2956 Server.exe 4424 Server.exe 2448 Server.exe 64 Server.exe 4348 Server.exe 3392 Server.exe 2872 Server.exe 4992 Server.exe 1092 Server.exe 4972 Server.exe 3652 Server.exe 464 Server.exe 588 Server.exe 3244 Server.exe 5012 Server.exe 3628 Server.exe 1940 Server.exe 752 Server.exe 1660 Server.exe 5112 Server.exe 588 Server.exe 5100 Server.exe 1432 Server.exe 3580 Server.exe 448 Server.exe 4512 Server.exe 3588 Server.exe 3752 Server.exe 2736 Server.exe 548 Server.exe 4460 Server.exe 3200 Server.exe 3348 Server.exe 308 Server.exe 2628 Server.exe 2908 Server.exe 3524 Server.exe 3424 Server.exe 2384 Server.exe 1804 Server.exe 1416 Server.exe 2540 Server.exe 4860 Server.exe -
Loads dropped DLL 64 IoCs
pid Process 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 1692 Server.exe 1692 Server.exe 1692 Server.exe 1692 Server.exe 1692 Server.exe 1692 Server.exe 1692 Server.exe 1336 Server.exe 1336 Server.exe 1336 Server.exe 1336 Server.exe 1336 Server.exe 1336 Server.exe 1336 Server.exe 524 Server.exe 524 Server.exe 524 Server.exe 524 Server.exe 524 Server.exe 524 Server.exe 524 Server.exe 4424 Server.exe 4424 Server.exe 4424 Server.exe 4424 Server.exe 4424 Server.exe 4424 Server.exe 4424 Server.exe 4348 Server.exe 4348 Server.exe 4348 Server.exe 4348 Server.exe 4348 Server.exe 4348 Server.exe 4348 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 3652 Server.exe 3652 Server.exe 3652 Server.exe 3652 Server.exe 3652 Server.exe 3652 Server.exe 3652 Server.exe 3244 Server.exe 3244 Server.exe 3244 Server.exe 3244 Server.exe 3244 Server.exe 3244 Server.exe 3244 Server.exe 1940 Server.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{D09FB2FC-118A-4369-8C6E-96FE8A0D4298} = "C:\\Users\\Admin\\AppData\\Roaming\\{D09FB2FC-118A-4369-8C6E-96FE8A0D4298}\\svchost.exe" 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe -
Suspicious use of SetThreadContext 40 IoCs
description pid Process procid_target PID 2396 set thread context of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 4148 set thread context of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 1692 set thread context of 1000 1692 Server.exe 133 PID 1000 set thread context of 1156 1000 Server.exe 134 PID 1156 set thread context of 2632 1156 Server.exe 136 PID 524 set thread context of 4304 524 Server.exe 143 PID 4304 set thread context of 2956 4304 Server.exe 144 PID 4424 set thread context of 2448 4424 Server.exe 170 PID 2448 set thread context of 64 2448 Server.exe 173 PID 4348 set thread context of 3392 4348 Server.exe 193 PID 3392 set thread context of 2872 3392 Server.exe 194 PID 2872 set thread context of 4868 2872 Server.exe 196 PID 4992 set thread context of 1092 4992 Server.exe 198 PID 1092 set thread context of 4972 1092 Server.exe 199 PID 3652 set thread context of 464 3652 Server.exe 223 PID 464 set thread context of 588 464 Server.exe 226 PID 3244 set thread context of 5012 3244 Server.exe 248 PID 5012 set thread context of 3628 5012 Server.exe 249 PID 3628 set thread context of 3464 3628 Server.exe 251 PID 1940 set thread context of 752 1940 Server.exe 253 PID 752 set thread context of 1660 752 Server.exe 254 PID 5112 set thread context of 588 5112 Server.exe 278 PID 588 set thread context of 5100 588 Server.exe 280 PID 1432 set thread context of 3580 1432 Server.exe 301 PID 3580 set thread context of 448 3580 Server.exe 302 PID 448 set thread context of 3644 448 Server.exe 304 PID 4512 set thread context of 3588 4512 Server.exe 310 PID 3588 set thread context of 3752 3588 Server.exe 311 PID 2736 set thread context of 548 2736 Server.exe 338 PID 548 set thread context of 4460 548 Server.exe 343 PID 3200 set thread context of 3348 3200 Server.exe 361 PID 3348 set thread context of 308 3348 Server.exe 362 PID 308 set thread context of 2800 308 Server.exe 364 PID 2628 set thread context of 2908 2628 Server.exe 366 PID 2908 set thread context of 3524 2908 Server.exe 367 PID 3424 set thread context of 2384 3424 Server.exe 391 PID 2384 set thread context of 1804 2384 Server.exe 394 PID 1416 set thread context of 2540 1416 Server.exe 417 PID 2540 set thread context of 4860 2540 Server.exe 418 PID 4860 set thread context of 632 4860 Server.exe 420 -
resource yara_rule behavioral2/memory/2632-124-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-126-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-125-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-128-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-129-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-130-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-131-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-133-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-135-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-134-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-138-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2632-139-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/4868-256-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/4868-257-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/4868-255-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/4868-259-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/4868-258-0x0000000001610000-0x0000000001715000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe File created C:\Windows\InstallDir\Server.exe 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3436 1336 WerFault.exe 132 -
System Location Discovery: System Language Discovery 1 TTPs 59 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000b000000023b8b-54.dat nsis_installer_1 behavioral2/files/0x000b000000023b8b-54.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 48 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2632 explorer.exe 2632 explorer.exe 4868 explorer.exe 4868 explorer.exe 3464 explorer.exe 3464 explorer.exe 3644 explorer.exe 3644 explorer.exe 2800 explorer.exe 2800 explorer.exe 632 explorer.exe 632 explorer.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 2632 explorer.exe 2956 Server.exe 4868 explorer.exe 4972 Server.exe 3464 explorer.exe 1660 Server.exe 3644 explorer.exe 3752 Server.exe 2800 explorer.exe 3524 Server.exe 632 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 2396 wrote to memory of 4148 2396 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 89 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 4148 wrote to memory of 2056 4148 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 90 PID 2056 wrote to memory of 1520 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 91 PID 2056 wrote to memory of 1520 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 91 PID 2056 wrote to memory of 1520 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 91 PID 2056 wrote to memory of 1520 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 91 PID 2056 wrote to memory of 4840 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 92 PID 2056 wrote to memory of 4840 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 92 PID 2056 wrote to memory of 948 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 93 PID 2056 wrote to memory of 948 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 93 PID 2056 wrote to memory of 948 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 93 PID 2056 wrote to memory of 5100 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 96 PID 2056 wrote to memory of 5100 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 96 PID 2056 wrote to memory of 5012 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 97 PID 2056 wrote to memory of 5012 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 97 PID 2056 wrote to memory of 5012 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 97 PID 2056 wrote to memory of 4812 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 98 PID 2056 wrote to memory of 4812 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 98 PID 2056 wrote to memory of 4780 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 99 PID 2056 wrote to memory of 4780 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 99 PID 2056 wrote to memory of 4780 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 99 PID 2056 wrote to memory of 4332 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 100 PID 2056 wrote to memory of 4332 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 100 PID 2056 wrote to memory of 2756 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 101 PID 2056 wrote to memory of 2756 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 101 PID 2056 wrote to memory of 2756 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 101 PID 2056 wrote to memory of 3904 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 102 PID 2056 wrote to memory of 3904 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 102 PID 2056 wrote to memory of 396 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 103 PID 2056 wrote to memory of 396 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 103 PID 2056 wrote to memory of 396 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 103 PID 2056 wrote to memory of 3144 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 104 PID 2056 wrote to memory of 3144 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 104 PID 2056 wrote to memory of 4088 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 105 PID 2056 wrote to memory of 4088 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 105 PID 2056 wrote to memory of 4088 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 105 PID 2056 wrote to memory of 660 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 106 PID 2056 wrote to memory of 660 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 106 PID 2056 wrote to memory of 3360 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 107 PID 2056 wrote to memory of 3360 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 107 PID 2056 wrote to memory of 3360 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 107 PID 2056 wrote to memory of 792 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 109 PID 2056 wrote to memory of 792 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 109 PID 2056 wrote to memory of 2360 2056 4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵PID:4928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 8286⤵
- Program crash
PID:3436
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:524 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2360
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3536
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5112
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5072
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4136
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2544
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2068
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3520
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4384
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4948
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4416
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4396
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2204
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4600
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2628
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1028
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3024
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4708
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2340
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:64 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3632
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4772
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2744
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4896
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:436
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4392
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4040
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2212
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:732
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:664
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4476
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1112
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3324
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3420
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4760
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1040
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4136
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2172
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3980
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1760
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1432
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3360
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4088
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:648
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3464
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3652 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:464 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4044
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2144
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:396
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3424
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2900
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:752 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4288
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3536
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4588
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4256
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3600
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5064
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1588
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3768
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4604
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1692
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4996
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:216
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3356
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4476
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1112
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1716
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3884
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1448
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3200
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3644
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:588 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4424
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:436
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1016
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4420
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4384
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3752 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3956
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4808
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4936
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4424
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:64
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:876
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4284
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4840
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4752
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1040
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4136
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:920
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4448
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5016
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4452
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5040
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1904
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2344
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3200 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:736
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:548 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:384
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1220
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4004
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3748
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3244
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4940
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4072
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3012
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2144
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1588
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3360
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2172
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5080
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3024
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4984
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1760
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2872
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:528
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1036
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1264
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2256
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2148
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4780
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2724
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe11⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:632
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1508
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1332
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2992
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3484
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe8⤵PID:2684
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4840
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:5100
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4812
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4332
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:3904
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:3144
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:660
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:792
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:2108
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:3464
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:996
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4484
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:364
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:308
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4280
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:1628
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:5072
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:4284
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:1660
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1336 -ip 13361⤵PID:2744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD501e195f30b535fe2c6bd19a958809799
SHA1c0fe3f2d18b630caac7760f1aa48eb1bcce1825f
SHA25654e3e33bdebf947b15503bb74ab87fcc2b25a5a2d88c287bc35960fdb102b48a
SHA512c55585f1ca6e42c71f834645f988acbe39d15f7a75f083c5c0f4ae1ba3b19e4be483707b18db36ceb51b30c15412d7e6a3f7a74ed7092b083060da0ffad21466
-
Filesize
11KB
MD5a5be4fbb8fe08060c779ee7f206f7e40
SHA10d7cd2613abce8133b2f0e6e88cdca345ce7afaa
SHA256c01b3508abdfdb58dae16e0de08792a0bb26be7f16d5be9abcbdd3f7fb573810
SHA5122db534046d3acb226813dc346923e2ae5eb666f3ce5686a7fb66a893e521bd2d17b6fc2c3c7c09fed351cfe535d441d9d85c44ea3ea154e9de83dc50caca42ae
-
Filesize
3KB
MD5327d5dabafb66291d1203a94a63ef331
SHA1d691cb16ec44deafdf02954f3421d2dd24f3f6a7
SHA25643f8f8e793c3db3cc526872c8fa847850757e14034b7749da0dfc69589ab176c
SHA5124935a6fa8f8a6efe02879c7285ae8bb111f6f937d83c46f77add46ee77686be13e5e28d9f662db7843e45a47787a728a558edd33e808718e5e2e17e4b769ecfe
-
Filesize
3KB
MD5ec2842e7e52ccfe32c3e9a18120b197e
SHA17106a5ba84c41d270948eb7d820322346c55e91b
SHA256cfefaef13e409dc106c18947038fde35616b72ba5d7f63a09665e1ece1aa49be
SHA51215999656ce30451d3e4fff18062a96aa84b13b68434f7af0fcf3e6fd04971906a85cb144bf2e2a6f7bfb907fd81fd7bf252f0f3823c5b9ef6bf60be6890d873e
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
2B
MD593e00066d099c0485cfffa1359246d26
SHA1bc69a773f37b2f2071e25f755a66d47b871e5d98
SHA2563b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde
SHA512d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02
-
Filesize
3KB
MD54adbc3c8649c774a28c9a2ddcbef5650
SHA1a085559a45ca7f7de2a55a9d895b7ec57fc8d3c1
SHA256dd673c84b04cda3df515d3756a52e1b05b57e3e8f56dc442e337f6acccded752
SHA5127cb75aaf8949f00bbcd20caed0d8532a9c981929029774f86f190a8a1df05d6002cc57ce8442a34728ce11c8f7757a585792d9fa46644c8297fa616878c41d57
-
Filesize
346KB
MD5d66a2c0bab8c432e8db0e0ec5ea7cdd7
SHA1beae77cb01b5c20095571a848461594d1b8ffb33
SHA256c3aad752da5499aa3efc4725bda75e3cb5d33ac00ffbd4cfa99fa2a9d2fbf1ab
SHA51271f22d8e23eda765af102bd2be1d50f630abc06cf494fa03d19276cf8110d5272f5296604395d5a5e8e12009f512df2a66c59581baf813c48b579cbe84446eeb
-
Filesize
457KB
MD54af88ef4a6ceca1e24db838015deac2b
SHA1b0a62cf9928e8d6a424b4d2c962feb127ae0ab5a
SHA2563b502edbf977c5a629a89dca66683d9f3c79588b47dcf4177fc492fe01187c43
SHA5128ea3197dc05832b8be3de4b4900af76d989bbbc7645f81966fecfafba3d6acddd79b649037c7169ba4f702d0fdb14d7ec6cd5c460e3b6c5e70dabf64bbe39d3b