xtremerat | cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Size

720KB
MD5

79a5196da396b96343044126f66d4edc
SHA1

a2a864d1aa86d2309c88c205de87b0024cb51522
SHA256

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1
SHA512

308c831918f71de6501ddc6983c2fca3aa727940a932f44cf5e7beb7a20e2860aa4b070778b4a1320315c3589ec8b2f97c1012cc2371d89b4d036b843f1af554
SSDEEP

12288:e+XbsaO1RUgWA6MKedpjpKNNt6vSR5SFgeiqRwMnJZQDx8XCj1B6CwbqR:Zr7WUZA6MKSWPNTDx8XCUbw

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1948-16-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/1948-21-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/1948-18-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/1948-17-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/1948-41-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 62 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

Checks BIOS information in registry 2 TTPs 62 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe

Executes dropped EXE 60 IoCs

pid	Process
2900	Server.exe
2716	Server.exe
1976	Server.exe
2004	Server.exe
1904	Server.exe
2456	Server.exe
1868	Server.exe
1728	Server.exe
2056	Server.exe
2400	Server.exe
1964	Server.exe
3040	Server.exe
1480	Server.exe
2692	Server.exe
804	Server.exe
2736	Server.exe
1260	Server.exe
1012	Server.exe
2156	Server.exe
1612	Server.exe
2924	Server.exe
272	Server.exe
316	Server.exe
2000	Server.exe
484	Server.exe
3060	Server.exe
1884	Server.exe
2344	Server.exe
2920	Server.exe
1696	Server.exe
1260	Server.exe
1940	Server.exe
1156	Server.exe
3012	Server.exe
1692	Server.exe
484	Server.exe
2940	Server.exe
2432	Server.exe
1948	Server.exe
2696	Server.exe
872	Server.exe
1152	Server.exe
2812	Server.exe
2544	Server.exe
1788	Server.exe
2432	Server.exe
3124	Server.exe
3192	Server.exe
3336	Server.exe
3404	Server.exe
3544	Server.exe
3612	Server.exe
3756	Server.exe
3824	Server.exe
3968	Server.exe
4036	Server.exe
3200	Server.exe
3308	Server.exe
3520	Server.exe
3600	Server.exe

Loads dropped DLL 3 IoCs

pid	Process
1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
2900	Server.exe

Adds Run key to start application 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\60433825_04big.jpg	DllHost.exe
File created	C:\Windows\SysWOW64\60433825_04big.jpg.exe	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\60433825_04big.jpg	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2900 set thread context of 2716	2900	Server.exe	42
PID 1976 set thread context of 2004	1976	Server.exe	52
PID 1904 set thread context of 2456	1904	Server.exe	62
PID 1868 set thread context of 1728	1868	Server.exe	72
PID 2056 set thread context of 2400	2056	Server.exe	82
PID 1964 set thread context of 3040	1964	Server.exe	92
PID 1480 set thread context of 2692	1480	Server.exe	102
PID 804 set thread context of 2736	804	Server.exe	112
PID 1260 set thread context of 1012	1260	Server.exe	122
PID 2156 set thread context of 1612	2156	Server.exe	132
PID 2924 set thread context of 272	2924	Server.exe	142
PID 316 set thread context of 2000	316	Server.exe	152
PID 484 set thread context of 3060	484	Server.exe	162
PID 1884 set thread context of 2344	1884	Server.exe	172
PID 2920 set thread context of 1696	2920	Server.exe	182
PID 1260 set thread context of 1940	1260	Server.exe	193
PID 1156 set thread context of 3012	1156	Server.exe	203
PID 1692 set thread context of 484	1692	Server.exe	213
PID 2940 set thread context of 2432	2940	Server.exe	223
PID 1948 set thread context of 2696	1948	Server.exe	233
PID 872 set thread context of 1152	872	Server.exe	243
PID 2812 set thread context of 2544	2812	Server.exe	253
PID 1788 set thread context of 2432	1788	Server.exe	263
PID 3124 set thread context of 3192	3124	Server.exe	273
PID 3336 set thread context of 3404	3336	Server.exe	283
PID 3544 set thread context of 3612	3544	Server.exe	293
PID 3756 set thread context of 3824	3756	Server.exe	303
PID 3968 set thread context of 4036	3968	Server.exe	313
PID 3200 set thread context of 3308	3200	Server.exe	323
PID 3520 set thread context of 3600	3520	Server.exe	333

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiOQWNOKGC\x7fvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqr{XRqKgB\x7foF`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiTQWNOKGCdvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErj{XRqKNsWuIp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiVQWNOKGCfvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErz{XRqKVANIG`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi\\QWNOKGClvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsn{XRqKAxUe\x7fp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiUQWNOKGCevME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErf{XRqKfhrSzp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi^QWNOKGCnvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsz{XRqKuHiy~p"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiQQWNOKGCavME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErF{XRqKWLAkfP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiRQWNOKGCbvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErZ{XRqKge}q[@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiEQWNOKGCuvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpf{XRqKp{dC~p"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiJQWNOKGCzvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEq^{XRqK~}iqi@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiPQWNOKGC`vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErJ{XRqK\x7fWdMUP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiIQWNOKGCyvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqF{XRqKbVpK[@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiLQWNOKGC\|vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqn{XRqKWkCu{p"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiZQWNOKGCjvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsZ{XRqKDlZAbP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\InProcServer32\ThreadingModel = "Both"	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiBQWNOKGCrvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEp^{XRqK]tNAPP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiIQWNOKGCyvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqB{XRqKNTUkTP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiXQWNOKGChvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsJ{XRqK\\^C}l@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\ = "Shell File System Folder"	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiDQWNOKGCtvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpn{XRqKtbdEB`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiRQWNOKGCbvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEr^{XRqKKgXQTP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiJQWNOKGCzvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqZ{XRqKR\x7fLQfP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiTQWNOKGCdvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErn{XRqKbqrUF`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiFQWNOKGCvvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEp~{XRqKlP}yLp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiHQWNOKGCxvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqN{XRqKfOpMgP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiHQWNOKGCxvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqJ{XRqKJMUmh@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi[QWNOKGCkvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsV{XRqKlw\x7fgQP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiPQWNOKGC`vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErN{XRqKSUAmZ@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiSQWNOKGCcvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErV{XRqKO~XWh@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\InProcServer32	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiDQWNOKGCtvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpj{XRqKX`AeMp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiEQWNOKGCuvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpb{XRqK\\yAcq`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiLQWNOKGC\|vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqj{XRqK{ifUt`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi]QWNOKGCmvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsb{XRqKicpCLp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiGQWNOKGCwvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpr{XRqKDKX_\x7fp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiUQWNOKGCevME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErb{XRqKJjWsu`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiWQWNOKGCgvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErv{XRqK~Zkot`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiXQWNOKGChvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsN{XRqKp\\f]cP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi[QWNOKGCkvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsR{XRqK@uZG^@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJi^QWNOKGCnvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEs~{XRqKYJLYq`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiGQWNOKGCwvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpv{XRqKhI}\x7fp`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiNQWNOKGC~vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqz{XRqKc[\x7fizp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENR}aM}rix^\|p\|\\J]m~{oVJiOQWNOKGC\x7fvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqv{XRqKK@ZOIp"	Server.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: 33	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
Token: 33	2900	Server.exe
Token: SeIncBasePriorityPrivilege	2900	Server.exe
Token: 33	1976	Server.exe
Token: SeIncBasePriorityPrivilege	1976	Server.exe
Token: 33	1904	Server.exe
Token: SeIncBasePriorityPrivilege	1904	Server.exe
Token: 33	1868	Server.exe
Token: SeIncBasePriorityPrivilege	1868	Server.exe
Token: 33	2056	Server.exe
Token: SeIncBasePriorityPrivilege	2056	Server.exe
Token: 33	1964	Server.exe
Token: SeIncBasePriorityPrivilege	1964	Server.exe
Token: 33	1480	Server.exe
Token: SeIncBasePriorityPrivilege	1480	Server.exe
Token: 33	804	Server.exe
Token: SeIncBasePriorityPrivilege	804	Server.exe
Token: 33	1260	Server.exe
Token: SeIncBasePriorityPrivilege	1260	Server.exe
Token: 33	2156	Server.exe
Token: SeIncBasePriorityPrivilege	2156	Server.exe
Token: 33	2924	Server.exe
Token: SeIncBasePriorityPrivilege	2924	Server.exe
Token: 33	316	Server.exe
Token: SeIncBasePriorityPrivilege	316	Server.exe
Token: 33	484	Server.exe
Token: SeIncBasePriorityPrivilege	484	Server.exe
Token: 33	1884	Server.exe
Token: SeIncBasePriorityPrivilege	1884	Server.exe
Token: 33	2920	Server.exe
Token: SeIncBasePriorityPrivilege	2920	Server.exe
Token: 33	1260	Server.exe
Token: SeIncBasePriorityPrivilege	1260	Server.exe
Token: 33	1156	Server.exe
Token: SeIncBasePriorityPrivilege	1156	Server.exe
Token: 33	1692	Server.exe
Token: SeIncBasePriorityPrivilege	1692	Server.exe
Token: 33	2940	Server.exe
Token: SeIncBasePriorityPrivilege	2940	Server.exe
Token: 33	1948	Server.exe
Token: SeIncBasePriorityPrivilege	1948	Server.exe
Token: 33	872	Server.exe
Token: SeIncBasePriorityPrivilege	872	Server.exe
Token: 33	2812	Server.exe
Token: SeIncBasePriorityPrivilege	2812	Server.exe
Token: 33	1788	Server.exe
Token: SeIncBasePriorityPrivilege	1788	Server.exe
Token: 33	3124	Server.exe
Token: SeIncBasePriorityPrivilege	3124	Server.exe
Token: 33	3336	Server.exe
Token: SeIncBasePriorityPrivilege	3336	Server.exe
Token: 33	3544	Server.exe
Token: SeIncBasePriorityPrivilege	3544	Server.exe
Token: 33	3756	Server.exe
Token: SeIncBasePriorityPrivilege	3756	Server.exe
Token: 33	3968	Server.exe
Token: SeIncBasePriorityPrivilege	3968	Server.exe
Token: 33	3200	Server.exe
Token: SeIncBasePriorityPrivilege	3200	Server.exe
Token: 33	3520	Server.exe
Token: SeIncBasePriorityPrivilege	3520	Server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	DllHost.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
2900	Server.exe
2268	DllHost.exe
2268	DllHost.exe
1976	Server.exe
1904	Server.exe
1868	Server.exe
2056	Server.exe
1964	Server.exe
1480	Server.exe
804	Server.exe
1260	Server.exe
2156	Server.exe
2924	Server.exe
316	Server.exe
484	Server.exe
1884	Server.exe
2920	Server.exe
1260	Server.exe
1156	Server.exe
1692	Server.exe
2940	Server.exe
1948	Server.exe
872	Server.exe
2812	Server.exe
1788	Server.exe
3124	Server.exe
3336	Server.exe
3544	Server.exe
3756	Server.exe
3968	Server.exe
3200	Server.exe
3520	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1948	2068	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2188	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2188	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2188	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2188	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2188	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2748	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2748	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2748	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2748	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2748	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	33
PID 1948 wrote to memory of 1032	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	34
PID 1948 wrote to memory of 1032	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	34
PID 1948 wrote to memory of 1032	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	34
PID 1948 wrote to memory of 1032	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	34
PID 1948 wrote to memory of 1032	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	34
PID 1948 wrote to memory of 2744	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2744	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2744	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2744	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2744	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2784	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2784	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2784	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2784	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2784	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2840	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2840	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2840	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2840	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2840	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2856	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2856	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2856	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2856	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2856	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2864	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2864	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2864	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2864	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2900	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	41
PID 1948 wrote to memory of 2900	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	41
PID 1948 wrote to memory of 2900	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	41
PID 1948 wrote to memory of 2900	1948	79a5196da396b96343044126f66d4edc_JaffaCakes118.exe	41
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42
PID 2900 wrote to memory of 2716	2900	Server.exe	42

C:\Users\Admin\AppData\Local\Temp\79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79a5196da396b96343044126f66d4edc_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\79a5196da396b96343044126f66d4edc_JaffaCakes118.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2188
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2748
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1032
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2744
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2784
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2840
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2856
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2864
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\InstallDir\Server.exe
      C:\Windows\InstallDir\Server.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2716
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2384
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2728
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2116
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2444
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1640
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2088
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2952
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1908
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:3000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2248
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:3052
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:3020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2060
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1244
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        14⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2644
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        16⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2316
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:804
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        18⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1904
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        20⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:792
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        21⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        22⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2460
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:348
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        23⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        24⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2976
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        25⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        26⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1684
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        27⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:484
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        28⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2304
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2516
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        29⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1884
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        30⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1992
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        31⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2920
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        32⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2408
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        33⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        34⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2924
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        35⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        36⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1920
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        37⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        38⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1356
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        39⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        40⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1964
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        41⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        42⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2568
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        43⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        44⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1288
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        45⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        46⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1764
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        47⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1788
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        48⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3112
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        49⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3124
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        50⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3260
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3320
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        51⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3336
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        52⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3532
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        53⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3544
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        54⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3744
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        55⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3756
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        56⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3956
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        57⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3968
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        58⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:4064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:1436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3180
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        59⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        60⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3328
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        61⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3520
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        62⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3612

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
e4d2b34cb35072321f311f4beddd9378

SHA1
e158638af667ddae79ea15ca00307bfd664104a5

SHA256
5f998ce37b1b7f6b5c0272f93cc5eac03c88ce81eaca931b8dabcbb4c861d031

SHA512
6309512f34e366eeeb87e4fe6041786c9506295a762d406206ed5dd2a52afc1cacfed51aff5f6ce9385438b0ecee42778cf09a3574940b55acbfadaa617c787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
bb9a3ab63d76cee59dabd3384185c64e

SHA1
3db2446778701a1e7f9099f3903b3081862fa7bb

SHA256
7df56078189cf6ff771c29d662232c20ff741839eeb8d7e887a6de9c53531c02

SHA512
d8ec3e017aa2798c5408b8e3a154e0eaee310348e92a380cd14ecb555eb9f223414447d9ec6227ced77bf12b0eb07db7cfc5b4a3a584ca37719bae3146d7211f

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
a3e2b8ee314dedd3571adc72764f3e3f

SHA1
0ffd65ec55841b067c14ce968b07e65b44d561f4

SHA256
efdaddf7227e3564700424e4948f9e9695cc9af78624631eafe760c6da3f0635

SHA512
18b2ac97e37ee613f9658959d166aa1a03f86495c9628c192fa383b71808dca6ce51980f32a381ed40e619091f29deb05dd83cd57c3e4110118211a4bff11797

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
fb914a9539867e82811e65377e8bed9a

SHA1
a92de522d918e7f1e9a2d740aee85fb4ff1ca78f

SHA256
fcdcaac1c108c562ec96016cc5dec183d8f713553966d9901a9d4e8c27d78605

SHA512
b5a9df5233a109dc2b9e641ee5342dc350ba3147703bfecd78a8c3032d6b73600e57c347456e0f102577ff95ded0ea3155b446ee7b99e0983b3ecc877ee50056

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
ed0c7d5c9372d6e7439a91e9b4efe2ac

SHA1
ce46d911daf29a6e20f191ba040ab38de5c9e1bc

SHA256
9acebbafd0bf0d30686b5b8b4636c0cfb0253b0a83f9f4f15fa37d18237963a6

SHA512
02b749d5798e3bbc0e728dd769286206dafc892535631abb4557077d5a8bc590930b8a1a5e67f845b203ee103d1ece438ac3d54923c3486ac9bead593a2eace3

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
f2a03a685737c53e6aa544691f8a57d0

SHA1
5f06228cb76858a0880d88b4c3a03a340ecbf8fd

SHA256
0474c819a8ba6eb0932ce439b1930b0700d75290bf3e95f05942fde72dc9cd66

SHA512
0a0d38e7d4ae624571e64ec7a34cbba4f485922e2015e91eaa7605dad34af27ff25f33a1570d01c7fc6336b596c972c4e4175ed932c6d0d3ad2f8d6bf15858c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
1b51eb3d1dbcc5f2337e7647c12582e5

SHA1
3908d0cc05028b91f7bb904c9ac4ba8abb28632f

SHA256
2ee7b59f2f6a9b6da2c9b519a4d2ae57323dc4c930cc3e2b1276dd29ece5ced6

SHA512
48fb34c483cef8a9063eb603f571d9502f52ebedb6568372ed5586d275878bd92afe7a9d24a0623cc941dad982231a59d685987119ed5a0b6928f51c7a695a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
fb6e091924753bf839450ff541a431ea

SHA1
1831a3fee73dc402777fa97548a901b27724e773

SHA256
e60c84631ce4ec4542c0751cafbd4c2cc21092f053da163b361ac00c5b9bbb62

SHA512
4eddede90f0ea718d652ed2438bce21381796c667d5ca7de2c0f25116bd6baf55aa56d9bdf3129ea281c791545ff0a523f6ae859958ff5759f739c4be1dcf585

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
d33092fc06d7c7b71d9e14f42770fa91

SHA1
f8e34485360cd5cff8035ae0bf0f83c8ea7c49df

SHA256
fa293248ba50845c99e4fe90d75bbd3f6a1106cfc5014be30d078f0289db8707

SHA512
ccdcb18abc69cff5d19ec64a19e5ce797289dcda9748d37e0613ce0003359cd3525b9c99a39f6b2e73b699ab8e7e2bf1da67a2db2e0ebee4bf24ec7668ae20ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
82ad325bd8d3571308343fcd6318715c

SHA1
11ec1ac9bda9afc84cdcf6776f2ac1e23cb2a118

SHA256
39b4f05c26889d5babab8fd20d62d018cf6b359a646033b8f8a24e743849e68b

SHA512
475062f9688ce15efb28bace0aa5637a372e94e49e1e26c2c539e1f77793dffa2836ff7d169691ee9735f38406d3f07e2f5e29313a88b0ef67d21928b12d2f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
10c1d785528d471a491504b5733e88b6

SHA1
0dc041e0ca197e824a6390748f562b8d46bb2034

SHA256
3859e417561e35f67fdbd4f50b842b0ad14a5c451d9dd6cb56ea7e3dd4779f1b

SHA512
86f8b705d6f65758e5f9b8ceb8fcbb6a252bb23c365d0a95672edac21c0a0fe29da6311c35be58a683afc1f6f89a08858d27777d6b05f77c67872284578ba6e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
e704926dbcb978ef81efe14788a17b21

SHA1
68733ce554a05087b74c73d8f8692357c505edc1

SHA256
19c1d9a7e8c11ed5b7019beabb57459fcb71469c565106abe2d01c792b86c895

SHA512
85452ff25b88acb3f7e1e22f66a474aad9b1df44fb121326d722c25cdbd508677ce6b50bb3b1017e1149d8da7dd5c11acebc57234506bd3e07a3bfcf3b888962

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
1336475d9a3ef8a1686efd0caa5fc3c4

SHA1
c3c80b21d91ea5ece400aef3f99364f10acc245f

SHA256
03b02d2cf86b2867b0b3a27acb99e638a0ba243d1d854e63d0081cd1d06e1b26

SHA512
5c8e479a8bbe6f0303fdfd04f4c6b8fddc563e449eb62aae40ab47c77231298e9fce07caeddf37e5bbd5f739563e166c28ca8e5375fa55f8aa22c5c9d647692c

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
9ba2ca7af0540821f205be98db2bcb2d

SHA1
6cfd202036bdbaa3d2b99c5863e84670a56b3d67

SHA256
790d299fbffcba9cf53c0676d6cc35c0ff466344cd7cde14aa9571414124dbf9

SHA512
13a7335ddf3ddd03f094637d7787542c604361db67882e9e3de63e0f57c42e65ef507be7675021631dda95eba6111d75c390c3d72bc9a5a86467af0e4405f082

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
9d9c026fc9d63995e2652319ae09f83a

SHA1
8346a278970f219eb9f9a7d2929e1046792577bb

SHA256
884c9de50ff8e9fd948342221bc8e0dea1a7a09d2c0d0676fd1279190fe40743

SHA512
f8af6dfc15101cc9eb082c2f35dd41585e042ae30745becf522dd7e962fda3d562d45be1325ea9029599c409f53d12f6d126f2a793857469c6e193664f606546

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
0ba42a03120e3b6b9b5f55b86a7d087d

SHA1
d5a5d1cd0bcf89cc7bd0c4920201c1cc7c2f27c4

SHA256
ef79caf60efe07ce9cd68403ae0d1ede11bf5c23c4f12909801d2ef6ed317ae9

SHA512
a3761d66a0a9d4590348e6f403dccfabd1b982eab2543fbd19c5d1bef0752ed6a12abf8d9d00529682804e9138a69749bb4159d076aada2dbbb34e4a81a3b637

Download Submit
C:\Windows\SysWOW64\60433825_04big.jpg

Filesize
205KB

MD5
91fa0e0f2ba3305e397a6f26c8fe3ee4

SHA1
e0b3e91c4106fad91fc872aeaee787d2e4210555

SHA256
03200b72d40d2e733ebf13494388eac37a98c9e72a7718e98a2bf3d500cb7c94

SHA512
5e9d93092349f5b4e87e92a17a0c434cf6342498cebac975774547d5b644a12e65cae49ec5d97c30683de016b7c28a7bbea278c85db04ccdbfb02bdba4e71e75

Download Submit
\Windows\InstallDir\Server.exe

Filesize
720KB

MD5
79a5196da396b96343044126f66d4edc

SHA1
a2a864d1aa86d2309c88c205de87b0024cb51522

SHA256
cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1

SHA512
308c831918f71de6501ddc6983c2fca3aa727940a932f44cf5e7beb7a20e2860aa4b070778b4a1320315c3589ec8b2f97c1012cc2371d89b4d036b843f1af554

Download Submit
memory/316-372-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/484-400-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/804-264-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/872-606-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1156-509-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1260-467-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1260-484-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1260-291-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1480-238-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1480-212-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1692-533-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1788-654-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1868-128-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1868-154-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1884-428-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1904-126-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1904-108-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1904-109-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1904-110-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1904-112-0x0000000000250000-0x0000000000299000-memory.dmp

Filesize
292KB

Download
memory/1904-101-0x0000000000250000-0x0000000000299000-memory.dmp

Filesize
292KB

Download
memory/1904-111-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1948-21-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/1948-558-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1948-582-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1948-40-0x00000000031F0000-0x00000000032D4000-memory.dmp

Filesize
912KB

Download
memory/1948-41-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/1948-42-0x00000000031F0000-0x00000000032D4000-memory.dmp

Filesize
912KB

Download
memory/1948-30-0x0000000002E30000-0x0000000002E32000-memory.dmp

Filesize
8KB

Download
memory/1948-17-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/1948-18-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/1948-16-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/1964-185-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1964-210-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1976-83-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1976-89-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1976-88-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/1976-87-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/1976-82-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1976-97-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1976-84-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1976-81-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1976-74-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1976-99-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1976-73-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2056-156-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2056-183-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-13-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2068-10-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2068-1-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2068-6-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2068-7-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-27-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-25-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2068-19-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2068-15-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2068-9-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-8-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2068-14-0x0000000000600000-0x0000000000602000-memory.dmp

Filesize
8KB

Download
memory/2156-320-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2156-293-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2268-72-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2268-31-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2268-33-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2812-630-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2900-54-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2900-45-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2900-44-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2900-55-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2900-53-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2900-69-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2900-66-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2900-63-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/2900-58-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/2900-59-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/2900-52-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2920-457-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2920-430-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2924-345-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2924-333-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2940-557-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3124-678-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3200-798-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3336-702-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3520-822-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3544-726-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3756-750-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3968-774-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads