xtremerat | 38e90a638c2d94ca427d48331c05729049a56ed9487e38fee3cfd6f855afba9f

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Size

436KB
MD5

a6a9e9adfc4c2d56d61765fea229f367
SHA1

72781be5f79d9cdcb25e3431a3e4a2e64ee64d10
SHA256

38e90a638c2d94ca427d48331c05729049a56ed9487e38fee3cfd6f855afba9f
SHA512

c6c13ee9205dac6c9f83be5f8a940f6c837d6b8eea2e7906ac293aff78669218623c8cd8d4b9ae1c8bbaefcf3528477a80c9ac8d590bba9fc70bd7c4971897a2
SSDEEP

12288:GjRLBCO5dIEGpzK6FSkFvVzkEGZosTj9U7++D+Ty:GjFRi5pzvJXGZHe7LDOy

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2820-17-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2820-18-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 62 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}\StubPath = "C:\\Windows\\InstallDir\\hotup.exe restart"	hotup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1SCI5066-RX8J-Y32G-WDC0-N131WBACYWP8}	hotup.exe

Executes dropped EXE 60 IoCs

pid	Process
3008	hotup.exe
2652	hotup.exe
436	hotup.exe
1960	hotup.exe
2616	hotup.exe
2372	hotup.exe
2156	hotup.exe
1588	hotup.exe
1888	hotup.exe
988	hotup.exe
2212	hotup.exe
2824	hotup.exe
1852	hotup.exe
2448	hotup.exe
2964	hotup.exe
1692	hotup.exe
2860	hotup.exe
2244	hotup.exe
2084	hotup.exe
1416	hotup.exe
320	hotup.exe
2304	hotup.exe
2424	hotup.exe
1640	hotup.exe
2032	hotup.exe
2096	hotup.exe
2884	hotup.exe
2792	hotup.exe
2084	hotup.exe
1960	hotup.exe
2108	hotup.exe
2364	hotup.exe
2824	hotup.exe
300	hotup.exe
2676	hotup.exe
2284	hotup.exe
1672	hotup.exe
2328	hotup.exe
1188	hotup.exe
1092	hotup.exe
2200	hotup.exe
1660	hotup.exe
2320	hotup.exe
2284	hotup.exe
1956	hotup.exe
2108	hotup.exe
3100	hotup.exe
3124	hotup.exe
3264	hotup.exe
3288	hotup.exe
3424	hotup.exe
3444	hotup.exe
3580	hotup.exe
3604	hotup.exe
3744	hotup.exe
3768	hotup.exe
3912	hotup.exe
3936	hotup.exe
4068	hotup.exe
4088	hotup.exe

Loads dropped DLL 3 IoCs

pid	Process
2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
3008	hotup.exe

Adds Run key to start application 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\hotup.exe"	hotup.exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 3008 set thread context of 2652	3008	hotup.exe	40
PID 436 set thread context of 1960	436	hotup.exe	50
PID 2616 set thread context of 2372	2616	hotup.exe	60
PID 2156 set thread context of 1588	2156	hotup.exe	70
PID 1888 set thread context of 988	1888	hotup.exe	80
PID 2212 set thread context of 2824	2212	hotup.exe	90
PID 1852 set thread context of 2448	1852	hotup.exe	100
PID 2964 set thread context of 1692	2964	hotup.exe	110
PID 2860 set thread context of 2244	2860	hotup.exe	120
PID 2084 set thread context of 1416	2084	hotup.exe	130
PID 320 set thread context of 2304	320	hotup.exe	140
PID 2424 set thread context of 1640	2424	hotup.exe	150
PID 2032 set thread context of 2096	2032	hotup.exe	160
PID 2884 set thread context of 2792	2884	hotup.exe	170
PID 2084 set thread context of 1960	2084	hotup.exe	180
PID 2108 set thread context of 2364	2108	hotup.exe	190
PID 2824 set thread context of 300	2824	hotup.exe	200
PID 2676 set thread context of 2284	2676	hotup.exe	210
PID 1672 set thread context of 2328	1672	hotup.exe	221
PID 1188 set thread context of 1092	1188	hotup.exe	231
PID 2200 set thread context of 1660	2200	hotup.exe	241
PID 2320 set thread context of 2284	2320	hotup.exe	251
PID 1956 set thread context of 2108	1956	hotup.exe	261
PID 3100 set thread context of 3124	3100	hotup.exe	271
PID 3264 set thread context of 3288	3264	hotup.exe	281
PID 3424 set thread context of 3444	3424	hotup.exe	291
PID 3580 set thread context of 3604	3580	hotup.exe	301
PID 3744 set thread context of 3768	3744	hotup.exe	311
PID 3912 set thread context of 3936	3912	hotup.exe	321
PID 4068 set thread context of 4088	4068	hotup.exe	331

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File created	C:\Windows\InstallDir\hotup.exe	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
File opened for modification	C:\Windows\InstallDir\	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe
File opened for modification	C:\Windows\InstallDir\hotup.exe	hotup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotup.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
3008	hotup.exe
436	hotup.exe
2616	hotup.exe
2156	hotup.exe
1888	hotup.exe
2212	hotup.exe
1852	hotup.exe
2964	hotup.exe
2860	hotup.exe
2084	hotup.exe
320	hotup.exe
2424	hotup.exe
2032	hotup.exe
2884	hotup.exe
2084	hotup.exe
2108	hotup.exe
2824	hotup.exe
2676	hotup.exe
1672	hotup.exe
1188	hotup.exe
2200	hotup.exe
2320	hotup.exe
1956	hotup.exe
3100	hotup.exe
3264	hotup.exe
3424	hotup.exe
3580	hotup.exe
3744	hotup.exe
3912	hotup.exe
4068	hotup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2532 wrote to memory of 2820	2532	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	30
PID 2820 wrote to memory of 2880	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	31
PID 2820 wrote to memory of 2880	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	31
PID 2820 wrote to memory of 2880	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	31
PID 2820 wrote to memory of 2880	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	31
PID 2820 wrote to memory of 2880	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	31
PID 2820 wrote to memory of 2864	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	32
PID 2820 wrote to memory of 2864	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	32
PID 2820 wrote to memory of 2864	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	32
PID 2820 wrote to memory of 2864	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	32
PID 2820 wrote to memory of 2864	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	32
PID 2820 wrote to memory of 2872	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	33
PID 2820 wrote to memory of 2872	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	33
PID 2820 wrote to memory of 2872	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	33
PID 2820 wrote to memory of 2872	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	33
PID 2820 wrote to memory of 2872	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	33
PID 2820 wrote to memory of 2668	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	34
PID 2820 wrote to memory of 2668	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	34
PID 2820 wrote to memory of 2668	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	34
PID 2820 wrote to memory of 2668	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	34
PID 2820 wrote to memory of 2668	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	34
PID 2820 wrote to memory of 1448	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	35
PID 2820 wrote to memory of 1448	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	35
PID 2820 wrote to memory of 1448	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	35
PID 2820 wrote to memory of 1448	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	35
PID 2820 wrote to memory of 1448	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	35
PID 2820 wrote to memory of 3028	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	36
PID 2820 wrote to memory of 3028	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	36
PID 2820 wrote to memory of 3028	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	36
PID 2820 wrote to memory of 3028	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	36
PID 2820 wrote to memory of 3028	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	36
PID 2820 wrote to memory of 2960	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	37
PID 2820 wrote to memory of 2960	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	37
PID 2820 wrote to memory of 2960	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	37
PID 2820 wrote to memory of 2960	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	37
PID 2820 wrote to memory of 2960	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	37
PID 2820 wrote to memory of 2828	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	38
PID 2820 wrote to memory of 2828	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	38
PID 2820 wrote to memory of 2828	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	38
PID 2820 wrote to memory of 2828	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	38
PID 2820 wrote to memory of 3008	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	39
PID 2820 wrote to memory of 3008	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	39
PID 2820 wrote to memory of 3008	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	39
PID 2820 wrote to memory of 3008	2820	JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe	39
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40
PID 3008 wrote to memory of 2652	3008	hotup.exe	40

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2880
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2864
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2872
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2668
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1448
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:3028
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2960
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2828
- - C:\Windows\InstallDir\hotup.exe
    "C:\Windows\InstallDir\hotup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\InstallDir\hotup.exe
      C:\Windows\InstallDir\hotup.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2652
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:840
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1572
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:304
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1788
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2260
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2272
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2116
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2488
    - - C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:436
      - C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:3056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1604
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:984
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:940
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1508
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2660
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        14⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:3020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:1100
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        16⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2124
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2964
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        18⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2912
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2860
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        20⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1204
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        22⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:3052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2332
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        24⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2168
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        26⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2056
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2032
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        28⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2180
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2356
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        30⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2712
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2704
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        32⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2160
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        34⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:3024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:608
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        36⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2768
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        38⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2512
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        40⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2364
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1736
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1336
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1188
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        42⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2748
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        44⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2452
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:300
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        46⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1476
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        48⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2096
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:1672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:2284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3076
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3100
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        50⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3240
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        52⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3400
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        54⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3556
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        56⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3716
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3744
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        58⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3888
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3912
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        60⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:4004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:4016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:4024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:4036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:4044
        
        C:\Windows\InstallDir\hotup.exe
        
        "C:\Windows\InstallDir\hotup.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4068
        
        C:\Windows\InstallDir\hotup.exe
        
        C:\Windows\InstallDir\hotup.exe
        62⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:2108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Fc0sBH.cfg

Filesize
1KB

MD5
9c4284f5cf565126e9f24fd35cc5f22f

SHA1
bd9bddfe09293701691849dc26f95bc9b104b005

SHA256
f558a02382c1ea6d548201b38808556b116c62fea2d75e39f9011bdba51bd183

SHA512
e798692f027d4f618af2c83e7615167116b531fcbf1e2dfcfc493c55640cda257cb8d5ddb5384fc09cbc8151cce60f5154248927b53ff8492d83fde9bf56d752

Download Submit
C:\Windows\InstallDir\hotup.exe

Filesize
436KB

MD5
a6a9e9adfc4c2d56d61765fea229f367

SHA1
72781be5f79d9cdcb25e3431a3e4a2e64ee64d10

SHA256
38e90a638c2d94ca427d48331c05729049a56ed9487e38fee3cfd6f855afba9f

SHA512
c6c13ee9205dac6c9f83be5f8a940f6c837d6b8eea2e7906ac293aff78669218623c8cd8d4b9ae1c8bbaefcf3528477a80c9ac8d590bba9fc70bd7c4971897a2

Download Submit
memory/320-163-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/436-59-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/436-53-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1188-257-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1188-252-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1672-249-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1852-116-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1852-109-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1888-90-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1888-94-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1956-283-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1956-277-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2032-177-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2032-184-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2084-145-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2084-151-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2084-206-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2108-218-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2108-214-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2156-76-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2156-82-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2200-260-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2200-266-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2212-104-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2212-98-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2320-274-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2424-174-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2532-8-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2532-3-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2532-4-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2532-6-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2532-7-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2532-11-0x0000000003610000-0x0000000003611000-memory.dmp

Filesize
4KB

Download
memory/2532-9-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2532-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2532-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2532-15-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2532-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2532-13-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/2532-22-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2532-1-0x0000000000310000-0x000000000036A000-memory.dmp

Filesize
360KB

Download
memory/2532-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2532-21-0x0000000000310000-0x000000000036A000-memory.dmp

Filesize
360KB

Download
memory/2532-10-0x0000000003510000-0x0000000003518000-memory.dmp

Filesize
32KB

Download
memory/2616-71-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2616-65-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2676-241-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2676-237-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2820-37-0x00000000035E0000-0x00000000036AF000-memory.dmp

Filesize
828KB

Download
memory/2820-36-0x00000000035E0000-0x00000000036AF000-memory.dmp

Filesize
828KB

Download
memory/2820-17-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2820-18-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2820-19-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2824-226-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2824-230-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2860-140-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2860-133-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2884-194-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2884-190-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2964-128-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3008-40-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3008-47-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3100-286-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3100-292-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3264-295-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3264-301-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3424-309-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3580-312-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3580-318-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3744-321-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3744-327-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3912-335-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/4068-343-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads