Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
Resource
win10v2004-20231215-en
General
-
Target
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
-
Size
1.2MB
-
MD5
06631fd7bbbf9c0f7cd7527ff3a46b1f
-
SHA1
a5df5fa915723c4166eaf02fb5f9dd280bf05ceb
-
SHA256
8c17b6f8c84d9743d224183cbf91dd710974aedbc3bd7f74e4ef493eec94e662
-
SHA512
b275ac195c1dc9fd06705a7089758a198a9a04e97df05e416367a258db2ef4a9957e7128429609b7dc0b368cc1a02f0d9b28422ef6fa2349f60ed543f5a792a1
-
SSDEEP
24576:so2ts4E59IrYnjtscr/dMYry/Zn1lTCvoKFmrj9G7yZlra2ST:U+9I6tssMYo/OvoNGqxavT
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2812 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1476 explorer.exe 2320 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE -
Loads dropped DLL 46 IoCs
pid Process 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE -
Writes to the Master Boot Record (MBR) 1 TTPs 8 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 explorer.exe File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\XP-AB9DB5FA.EXE 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe File created C:\Windows\SysWOW64\XP-AB9DB5FA.EXE 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe -
Suspicious use of SetWindowsHookEx 48 IoCs
pid Process 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2812 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 2628 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1704 XP-AB9DB5FA.EXE 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 2320 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 436 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE 1984 XP-AB9DB5FA.EXE -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2768 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 28 PID 2432 wrote to memory of 2768 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 28 PID 2432 wrote to memory of 2768 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 28 PID 2432 wrote to memory of 2768 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 28 PID 2432 wrote to memory of 2812 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 30 PID 2432 wrote to memory of 2812 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 30 PID 2432 wrote to memory of 2812 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 30 PID 2432 wrote to memory of 2812 2432 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 30 PID 2812 wrote to memory of 2816 2812 XP-AB9DB5FA.EXE 31 PID 2812 wrote to memory of 2816 2812 XP-AB9DB5FA.EXE 31 PID 2812 wrote to memory of 2816 2812 XP-AB9DB5FA.EXE 31 PID 2812 wrote to memory of 2816 2812 XP-AB9DB5FA.EXE 31 PID 2812 wrote to memory of 2628 2812 XP-AB9DB5FA.EXE 32 PID 2812 wrote to memory of 2628 2812 XP-AB9DB5FA.EXE 32 PID 2812 wrote to memory of 2628 2812 XP-AB9DB5FA.EXE 32 PID 2812 wrote to memory of 2628 2812 XP-AB9DB5FA.EXE 32 PID 2628 wrote to memory of 1104 2628 XP-AB9DB5FA.EXE 34 PID 2628 wrote to memory of 1104 2628 XP-AB9DB5FA.EXE 34 PID 2628 wrote to memory of 1104 2628 XP-AB9DB5FA.EXE 34 PID 2628 wrote to memory of 1104 2628 XP-AB9DB5FA.EXE 34 PID 2628 wrote to memory of 1704 2628 XP-AB9DB5FA.EXE 35 PID 2628 wrote to memory of 1704 2628 XP-AB9DB5FA.EXE 35 PID 2628 wrote to memory of 1704 2628 XP-AB9DB5FA.EXE 35 PID 2628 wrote to memory of 1704 2628 XP-AB9DB5FA.EXE 35 PID 1704 wrote to memory of 2136 1704 XP-AB9DB5FA.EXE 37 PID 1704 wrote to memory of 2136 1704 XP-AB9DB5FA.EXE 37 PID 1704 wrote to memory of 2136 1704 XP-AB9DB5FA.EXE 37 PID 1704 wrote to memory of 2136 1704 XP-AB9DB5FA.EXE 37 PID 1704 wrote to memory of 1476 1704 XP-AB9DB5FA.EXE 72 PID 1704 wrote to memory of 1476 1704 XP-AB9DB5FA.EXE 72 PID 1704 wrote to memory of 1476 1704 XP-AB9DB5FA.EXE 72 PID 1704 wrote to memory of 1476 1704 XP-AB9DB5FA.EXE 72 PID 1476 wrote to memory of 936 1476 explorer.exe 40 PID 1476 wrote to memory of 936 1476 explorer.exe 40 PID 1476 wrote to memory of 936 1476 explorer.exe 40 PID 1476 wrote to memory of 936 1476 explorer.exe 40 PID 1476 wrote to memory of 2320 1476 explorer.exe 41 PID 1476 wrote to memory of 2320 1476 explorer.exe 41 PID 1476 wrote to memory of 2320 1476 explorer.exe 41 PID 1476 wrote to memory of 2320 1476 explorer.exe 41 PID 2320 wrote to memory of 1920 2320 XP-AB9DB5FA.EXE 43 PID 2320 wrote to memory of 1920 2320 XP-AB9DB5FA.EXE 43 PID 2320 wrote to memory of 1920 2320 XP-AB9DB5FA.EXE 43 PID 2320 wrote to memory of 1920 2320 XP-AB9DB5FA.EXE 43 PID 2320 wrote to memory of 436 2320 XP-AB9DB5FA.EXE 44 PID 2320 wrote to memory of 436 2320 XP-AB9DB5FA.EXE 44 PID 2320 wrote to memory of 436 2320 XP-AB9DB5FA.EXE 44 PID 2320 wrote to memory of 436 2320 XP-AB9DB5FA.EXE 44 PID 436 wrote to memory of 1848 436 XP-AB9DB5FA.EXE 45 PID 436 wrote to memory of 1848 436 XP-AB9DB5FA.EXE 45 PID 436 wrote to memory of 1848 436 XP-AB9DB5FA.EXE 45 PID 436 wrote to memory of 1848 436 XP-AB9DB5FA.EXE 45 PID 436 wrote to memory of 1984 436 XP-AB9DB5FA.EXE 47 PID 436 wrote to memory of 1984 436 XP-AB9DB5FA.EXE 47 PID 436 wrote to memory of 1984 436 XP-AB9DB5FA.EXE 47 PID 436 wrote to memory of 1984 436 XP-AB9DB5FA.EXE 47 PID 1984 wrote to memory of 1980 1984 XP-AB9DB5FA.EXE 49 PID 1984 wrote to memory of 1980 1984 XP-AB9DB5FA.EXE 49 PID 1984 wrote to memory of 1980 1984 XP-AB9DB5FA.EXE 49 PID 1984 wrote to memory of 1980 1984 XP-AB9DB5FA.EXE 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe"C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f2⤵PID:2768
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA3⤵PID:2816
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA4⤵PID:1104
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA5⤵PID:2136
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE5⤵PID:1476
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA6⤵PID:936
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA7⤵PID:1920
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA8⤵PID:1848
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA9⤵PID:1980
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE9⤵PID:2232
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA10⤵PID:2328
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE10⤵PID:2384
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA11⤵PID:2708
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE11⤵PID:2848
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA12⤵PID:2680
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE12⤵PID:580
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA13⤵PID:1492
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE13⤵PID:2864
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA14⤵PID:1644
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE14⤵PID:2108
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA15⤵PID:1708
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE15⤵PID:2916
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA16⤵PID:1760
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE16⤵PID:1152
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA17⤵PID:2936
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE17⤵PID:2144
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA18⤵PID:2448
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE18⤵PID:2328
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA19⤵PID:2572
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE19⤵PID:764
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA20⤵PID:2548
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE20⤵PID:1828
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA21⤵PID:1324
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE21⤵PID:2476
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA22⤵PID:340
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE22⤵PID:1004
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA23⤵PID:2800
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE23⤵PID:2252
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA24⤵PID:2448
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE24⤵PID:2312
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA25⤵PID:1748
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE25⤵PID:1052
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA26⤵PID:2724
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE26⤵PID:1828
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA27⤵PID:2788
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE27⤵PID:1708
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA28⤵PID:1812
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE28⤵PID:2860
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA29⤵PID:2332
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE29⤵PID:2592
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA30⤵PID:820
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE30⤵PID:3180
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA31⤵PID:3244
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE31⤵PID:3344
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA32⤵PID:3400
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE32⤵PID:3476
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA33⤵PID:3540
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE33⤵PID:3592
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA34⤵PID:3660
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE34⤵PID:3724
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA35⤵PID:3780
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE35⤵PID:3836
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA36⤵PID:3920
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE36⤵PID:4020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA37⤵PID:4092
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE37⤵PID:2332
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA38⤵PID:3108
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE38⤵PID:3516
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA39⤵PID:3184
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE39⤵PID:3472
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA40⤵PID:3544
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE40⤵PID:3480
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA41⤵PID:3812
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE41⤵PID:3080
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA42⤵PID:3968
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE42⤵PID:764
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA43⤵PID:3772
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE43⤵PID:3184
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA44⤵PID:1812
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE44⤵PID:4020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA45⤵PID:3400
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE45⤵PID:3660
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA46⤵PID:3812
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE46⤵PID:4044
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA47⤵PID:3836
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE47⤵PID:3624
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA48⤵PID:4148
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE48⤵PID:4224
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA49⤵PID:4312
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE49⤵PID:4384
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA50⤵PID:4444
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE50⤵PID:4508
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA51⤵PID:4588
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE51⤵PID:4652
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA52⤵PID:4740
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE52⤵PID:4796
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA53⤵PID:4864
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE53⤵PID:4936
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA54⤵PID:5008
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE54⤵PID:5092
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA55⤵PID:4132
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE55⤵PID:3968
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA56⤵PID:4400
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE56⤵PID:4420
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA57⤵PID:4332
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE57⤵PID:4668
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA58⤵PID:4820
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE58⤵PID:4956
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA59⤵PID:4740
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE59⤵PID:4948
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA60⤵PID:4544
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE60⤵PID:4020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA61⤵PID:4404
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE61⤵PID:4312
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA62⤵PID:4968
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE62⤵PID:4868
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA63⤵PID:4904
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE63⤵PID:4948
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA64⤵PID:4508
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE64⤵PID:4224
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA65⤵PID:5164
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE65⤵PID:5224
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA66⤵PID:5300
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE66⤵PID:5352
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA67⤵PID:5424
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE67⤵PID:5496
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA68⤵PID:5640
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE68⤵PID:5708
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA69⤵PID:5784
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE69⤵PID:5820
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA70⤵PID:5880
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE70⤵PID:5936
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA71⤵PID:6024
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE71⤵PID:6076
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA72⤵PID:6136
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE72⤵PID:5240
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA73⤵PID:5108
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE73⤵PID:4556
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA74⤵PID:5304
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE74⤵PID:5424
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA75⤵PID:5864
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE75⤵PID:5804
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA76⤵PID:5824
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE76⤵PID:5260
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA77⤵PID:6024
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE77⤵PID:5476
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA78⤵PID:5752
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE78⤵PID:5228
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA79⤵PID:5176
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE79⤵PID:5184
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA80⤵PID:6004
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE80⤵PID:5740
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA81⤵PID:5712
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE81⤵PID:5268
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA82⤵PID:6172
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE82⤵PID:6236
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA83⤵PID:6344
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE83⤵PID:6440
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA84⤵PID:6496
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE84⤵PID:6560
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA85⤵PID:6620
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE85⤵PID:6688
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA86⤵PID:6800
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE86⤵PID:6848
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA87⤵PID:6956
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE87⤵PID:7008
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA88⤵PID:7136
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE88⤵PID:5864
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA89⤵PID:6256
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE89⤵PID:5756
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA90⤵PID:6280
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE90⤵PID:6712
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA91⤵PID:6496
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE91⤵PID:6620
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA92⤵PID:7028
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE92⤵PID:6688
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA93⤵PID:5752
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE93⤵PID:6344
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA94⤵PID:6796
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE94⤵PID:6976
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA95⤵PID:6808
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE95⤵PID:7028
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA96⤵PID:2416
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE96⤵PID:6152
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA97⤵PID:6236
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE97⤵PID:6652
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA98⤵PID:7196
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE98⤵PID:7268
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA99⤵PID:7320
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE99⤵PID:7416
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA100⤵PID:7480
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE100⤵PID:7548
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA101⤵PID:7716
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE101⤵PID:7776
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA102⤵PID:7832
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE102⤵PID:7872
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA103⤵PID:7920
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE103⤵PID:7976
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA104⤵PID:8076
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE104⤵PID:8120
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA105⤵PID:7028
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE105⤵PID:5752
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA106⤵PID:7264
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE106⤵PID:7324
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA107⤵PID:7888
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE107⤵PID:8004
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA108⤵PID:7548
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE108⤵PID:7872
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA109⤵PID:7172
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE109⤵PID:7468
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA110⤵PID:864
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE110⤵PID:2812
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA111⤵PID:7924
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE111⤵PID:8112
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA112⤵PID:7468
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE112⤵PID:7556
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA113⤵PID:7764
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE113⤵PID:7720
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA114⤵PID:8244
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE114⤵PID:8304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2292
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2972
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2952
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2512
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2308
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1156
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1624
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2100
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1436
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2796
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1172
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1096
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1488
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2508
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2980
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2660
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2616
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2052
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3068
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1964
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2144
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1716
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3212
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3356
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3508
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3648
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3748
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3900
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4012
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3336
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3428
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3696
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1828
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4092
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3672
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3588
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3724
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2580
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3612
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4232
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4428
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4524
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4824
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4992
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4100
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3224
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4584
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4804
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4768
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3184
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5096
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4288
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4404
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4484
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5252
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5400
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5512
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5716
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5844
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6124
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5312
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5528
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5836
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6084
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5544
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5780
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4224
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6140
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5384
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6308
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6608
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6872
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7000
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6164
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5268
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6720
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6952
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6956
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6316
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6788
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6160
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6752
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6572
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7304
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7440
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7596
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7784
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7928
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8012
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8180
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7372
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7572
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8044
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8060
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2716
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8088
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7980
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7760
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8196
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:8312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5a85d63acefa7a6fa639787e364c16892
SHA186ec32360c7ec9941b9411009de6aad0c83de46f
SHA256d0b26b744a94a6dc22eba1b79089c4e1f45db18a68a9b02f58f017b94873dcb8
SHA512fd12fbeab738358b47836badaf635511ea819fb5a35de4065b68d9b6f7e0f5eb443a7363164f32e8308701e78f2279c9c481038d09a2aa92a4ec184a91a2b9e8
-
Filesize
316KB
MD525b794b18bd8d03dc9530111cbce4173
SHA1a6774d62bd1e9497fdfe6c61c495011fc6c274c6
SHA25681757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4
SHA5125892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac
-
Filesize
180KB
MD556e9e121d68b5631a360d56b2ef4777f
SHA1e9d11a2baf46769c90ee1671cd17072efd8cfb52
SHA256c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f
SHA5121ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e
-
Filesize
72KB
MD5c4337f54ceb6765fda33f96b8408c013
SHA1242e447d71a346366526a721532b0d47d5d62239
SHA256a3525832c5922696002c33ca8658a53a3bbcdd46a1e172ee1f5e815f037b7c08
SHA5122bc2d4648b971f94e789815ce946578d412b585158056f10d2be147e194dfa8f4bd211eecb86b76aa78233da72b2544398945ca2850268109c6f3ef7e44a8c9c
-
Filesize
260KB
MD5ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
1.0MB
MD51081d7eb7a17faedfa588b93fc85365e
SHA1884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f
SHA2560351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0
SHA5121ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81
-
Filesize
40KB
MD5d54753e7fc3ea03aec0181447969c0e8
SHA1824e7007b6569ae36f174c146ae1b7242f98f734
SHA256192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9
SHA512c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f
-
Filesize
1.2MB
MD506631fd7bbbf9c0f7cd7527ff3a46b1f
SHA1a5df5fa915723c4166eaf02fb5f9dd280bf05ceb
SHA2568c17b6f8c84d9743d224183cbf91dd710974aedbc3bd7f74e4ef493eec94e662
SHA512b275ac195c1dc9fd06705a7089758a198a9a04e97df05e416367a258db2ef4a9957e7128429609b7dc0b368cc1a02f0d9b28422ef6fa2349f60ed543f5a792a1