8c17b6f8c84d9743d224183cbf91dd710974aedbc3bd7f74e4ef493eec94e662

Analysis

max time kernel
58s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
Size

1.2MB
MD5

06631fd7bbbf9c0f7cd7527ff3a46b1f
SHA1

a5df5fa915723c4166eaf02fb5f9dd280bf05ceb
SHA256

8c17b6f8c84d9743d224183cbf91dd710974aedbc3bd7f74e4ef493eec94e662
SHA512

b275ac195c1dc9fd06705a7089758a198a9a04e97df05e416367a258db2ef4a9957e7128429609b7dc0b368cc1a02f0d9b28422ef6fa2349f60ed543f5a792a1
SSDEEP

24576:so2ts4E59IrYnjtscr/dMYry/Zn1lTCvoKFmrj9G7yZlra2ST:U+9I6tssMYo/OvoNGqxavT

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4536	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
4452	XP-AB9DB5FA.EXE
3616	XP-AB9DB5FA.EXE
4972	explorer.exe
5108	XP-AB9DB5FA.EXE

Loads dropped DLL 64 IoCs

pid	Process
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE
4452	XP-AB9DB5FA.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE
File opened for modification	\??\PhysicalDrive0	explorer.exe
File opened for modification	\??\PhysicalDrive0	XP-AB9DB5FA.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XP-AB9DB5FA.EXE	Process not Found
File opened for modification	C:\Windows\SysWOW64\XP-AB9DB5FA.EXE	Process not Found

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 9 IoCs

pid	Process
1388	explorer.exe
4524	explorer.exe
1484	explorer.exe
1352	explorer.exe
1652	explorer.exe
2256	explorer.exe
2696	explorer.exe
4004	explorer.exe
3456	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4536	XP-AB9DB5FA.EXE
4524	explorer.exe
4524	explorer.exe
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
4568	XP-AB9DB5FA.EXE
1388	explorer.exe
1388	explorer.exe
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
4492	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
1484	explorer.exe
1484	explorer.exe
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
2220	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
1352	explorer.exe
1352	explorer.exe
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
3904	XP-AB9DB5FA.EXE
1652	explorer.exe
1652	explorer.exe
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
3244	XP-AB9DB5FA.EXE
2256	explorer.exe
2256	explorer.exe
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2568	XP-AB9DB5FA.EXE
2696	explorer.exe
2696	explorer.exe
2508	XP-AB9DB5FA.EXE
2508	XP-AB9DB5FA.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2256	1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe	93
PID 1584 wrote to memory of 2256	1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe	93
PID 1584 wrote to memory of 2256	1584	06631fd7bbbf9c0f7cd7527ff3a46b1f.exe	93
PID 1584 wrote to memory of 4536	1584	Process not Found	95
PID 1584 wrote to memory of 4536	1584	Process not Found	95
PID 1584 wrote to memory of 4536	1584	Process not Found	95
PID 4536 wrote to memory of 3168	4536	XP-AB9DB5FA.EXE	101
PID 4536 wrote to memory of 3168	4536	XP-AB9DB5FA.EXE	101
PID 4536 wrote to memory of 3168	4536	XP-AB9DB5FA.EXE	101
PID 4536 wrote to memory of 4568	4536	XP-AB9DB5FA.EXE	96
PID 4536 wrote to memory of 4568	4536	XP-AB9DB5FA.EXE	96
PID 4536 wrote to memory of 4568	4536	XP-AB9DB5FA.EXE	96
PID 4568 wrote to memory of 1840	4568	XP-AB9DB5FA.EXE	98
PID 4568 wrote to memory of 1840	4568	XP-AB9DB5FA.EXE	98
PID 4568 wrote to memory of 1840	4568	XP-AB9DB5FA.EXE	98
PID 4568 wrote to memory of 4492	4568	XP-AB9DB5FA.EXE	99
PID 4568 wrote to memory of 4492	4568	XP-AB9DB5FA.EXE	99
PID 4568 wrote to memory of 4492	4568	XP-AB9DB5FA.EXE	99
PID 4492 wrote to memory of 5044	4492	XP-AB9DB5FA.EXE	107
PID 4492 wrote to memory of 5044	4492	XP-AB9DB5FA.EXE	107
PID 4492 wrote to memory of 5044	4492	XP-AB9DB5FA.EXE	107
PID 4492 wrote to memory of 2220	4492	XP-AB9DB5FA.EXE	106
PID 4492 wrote to memory of 2220	4492	XP-AB9DB5FA.EXE	106
PID 4492 wrote to memory of 2220	4492	XP-AB9DB5FA.EXE	106
PID 2220 wrote to memory of 4952	2220	XP-AB9DB5FA.EXE	103
PID 2220 wrote to memory of 4952	2220	XP-AB9DB5FA.EXE	103
PID 2220 wrote to memory of 4952	2220	XP-AB9DB5FA.EXE	103
PID 2220 wrote to memory of 3904	2220	XP-AB9DB5FA.EXE	105
PID 2220 wrote to memory of 3904	2220	XP-AB9DB5FA.EXE	105
PID 2220 wrote to memory of 3904	2220	XP-AB9DB5FA.EXE	105
PID 3904 wrote to memory of 4816	3904	XP-AB9DB5FA.EXE	108
PID 3904 wrote to memory of 4816	3904	XP-AB9DB5FA.EXE	108
PID 3904 wrote to memory of 4816	3904	XP-AB9DB5FA.EXE	108
PID 3904 wrote to memory of 3244	3904	XP-AB9DB5FA.EXE	110
PID 3904 wrote to memory of 3244	3904	XP-AB9DB5FA.EXE	110
PID 3904 wrote to memory of 3244	3904	XP-AB9DB5FA.EXE	110
PID 3244 wrote to memory of 3568	3244	XP-AB9DB5FA.EXE	113
PID 3244 wrote to memory of 3568	3244	XP-AB9DB5FA.EXE	113
PID 3244 wrote to memory of 3568	3244	XP-AB9DB5FA.EXE	113
PID 3244 wrote to memory of 2568	3244	XP-AB9DB5FA.EXE	112
PID 3244 wrote to memory of 2568	3244	XP-AB9DB5FA.EXE	112
PID 3244 wrote to memory of 2568	3244	XP-AB9DB5FA.EXE	112
PID 2568 wrote to memory of 3920	2568	XP-AB9DB5FA.EXE	114
PID 2568 wrote to memory of 3920	2568	XP-AB9DB5FA.EXE	114
PID 2568 wrote to memory of 3920	2568	XP-AB9DB5FA.EXE	114
PID 2568 wrote to memory of 2508	2568	XP-AB9DB5FA.EXE	115
PID 2568 wrote to memory of 2508	2568	XP-AB9DB5FA.EXE	115
PID 2568 wrote to memory of 2508	2568	XP-AB9DB5FA.EXE	115
PID 2508 wrote to memory of 1988	2508	XP-AB9DB5FA.EXE	118
PID 2508 wrote to memory of 1988	2508	XP-AB9DB5FA.EXE	118
PID 2508 wrote to memory of 1988	2508	XP-AB9DB5FA.EXE	118
PID 2508 wrote to memory of 4452	2508	XP-AB9DB5FA.EXE	119
PID 2508 wrote to memory of 4452	2508	XP-AB9DB5FA.EXE	119
PID 2508 wrote to memory of 4452	2508	XP-AB9DB5FA.EXE	119
PID 4452 wrote to memory of 820	4452	XP-AB9DB5FA.EXE	121
PID 4452 wrote to memory of 820	4452	XP-AB9DB5FA.EXE	121
PID 4452 wrote to memory of 820	4452	XP-AB9DB5FA.EXE	121
PID 4452 wrote to memory of 3616	4452	XP-AB9DB5FA.EXE	122
PID 4452 wrote to memory of 3616	4452	XP-AB9DB5FA.EXE	122
PID 4452 wrote to memory of 3616	4452	XP-AB9DB5FA.EXE	122
PID 3616 wrote to memory of 2764	3616	XP-AB9DB5FA.EXE	124
PID 3616 wrote to memory of 2764	3616	XP-AB9DB5FA.EXE	124
PID 3616 wrote to memory of 2764	3616	XP-AB9DB5FA.EXE	124
PID 3616 wrote to memory of 4972	3616	XP-AB9DB5FA.EXE	138

C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
"C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f
  2⤵
  PID:2256
- C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
  C:\Windows\system32\XP-AB9DB5FA.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
    C:\Windows\system32\XP-AB9DB5FA.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
      C:\Windows\system32\XP-AB9DB5FA.EXE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2220
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        5⤵
        
        PID:5044
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
    3⤵
    PID:3168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1352

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:4952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
C:\Windows\system32\XP-AB9DB5FA.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
  2⤵
  PID:4816
- C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
  C:\Windows\system32\XP-AB9DB5FA.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
    C:\Windows\system32\XP-AB9DB5FA.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
      4⤵
      PID:3920
  - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
      C:\Windows\system32\XP-AB9DB5FA.EXE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        5⤵
        
        PID:1988
    - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        6⤵
        
        PID:820
      - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        7⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        7⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        8⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        8⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        9⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        9⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        10⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        10⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        11⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        11⤵
        
        PID:736
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        12⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        12⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        13⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        13⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        14⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        14⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        15⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        15⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        16⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        16⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        17⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        17⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        18⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        18⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        19⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        19⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        20⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        20⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        21⤵
        
        PID:576
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        21⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        22⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        22⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        23⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        23⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        24⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        24⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        25⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        25⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        26⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        26⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        27⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        27⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        28⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        28⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        29⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        29⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        30⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        30⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        31⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        31⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        32⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        32⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        33⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        33⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        34⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        34⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        35⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        35⤵
        
        PID:576
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        36⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        36⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        37⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        37⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        38⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        38⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        39⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        39⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        40⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        40⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        41⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        41⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        42⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        42⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        43⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        43⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        44⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        44⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        45⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        45⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        46⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        46⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        47⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        47⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        48⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        48⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        49⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        49⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        50⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        50⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        51⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        51⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        52⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        52⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        53⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        53⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        54⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        54⤵
        
        PID:844
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        55⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        55⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        56⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        56⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        57⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        57⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        58⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        58⤵
        
        PID:6420
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
    3⤵
    PID:3568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:4004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:3456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3032

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6304

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fne

Filesize
139KB

MD5
6f5dab94c51140d0d9f83b8f8c27ab46

SHA1
4c3c7e9dee23e5870f2b86b9f44aee7ece1143ad

SHA256
77e43da3c98ff72078af76ebb21cb8af699fc3a2d02124c837444bdba2ce89e5

SHA512
28f310b27b4543fbdac684d9eee8761f030ca17bc84d0172a2718ffb6238b1cb7b0e2b43f8a5d7a516fdf94a8f48b489e5bf5c23151d6ca60a989ab689f7ca2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fne

Filesize
125KB

MD5
6685ba5e9544847165c3ef3c664ca134

SHA1
8b8d4608dba51c91157a08ffbc2b39625f2f6b00

SHA256
5f13170a967c3caaafd1dad6086b0fd59c6928c219045f12f6772d39d50c0c51

SHA512
e80d7d4cbb3dd24ddbe5c386b99d8d60614e47a2661d8e1fe67297adb988b3fe723b2e6596b9807af63c6accd076f914f5e29731b643c804c63d1e4006ebe910

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fne

Filesize
14KB

MD5
955801c645fa7327952980b5dfce3bd6

SHA1
c528451180d68f5c6c57a4ed01a459e1108b38cb

SHA256
15806f8c76d185d433488128f61cad3cce014d09e0beba93822eadf5186ae78e

SHA512
adfe87bf6e0c7c75c3cbfb4ff2b93afe506b761e418b96c92dcfa441c640b8a75667d483435f0aefabb16fe4dd9c654c6f4960e032214c1d09248665419ac5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fne

Filesize
164KB

MD5
a85d63acefa7a6fa639787e364c16892

SHA1
86ec32360c7ec9941b9411009de6aad0c83de46f

SHA256
d0b26b744a94a6dc22eba1b79089c4e1f45db18a68a9b02f58f017b94873dcb8

SHA512
fd12fbeab738358b47836badaf635511ea819fb5a35de4065b68d9b6f7e0f5eb443a7363164f32e8308701e78f2279c9c481038d09a2aa92a4ec184a91a2b9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
133KB

MD5
f1faa8f5dbc62d208293ee450be60568

SHA1
3e06c68b4afb6c6e08cf2d5b64e9cc1f54a4aec2

SHA256
41934d41fc71f66e1a897e23b909b6db6a6ada28267326ab652a161ed58919b0

SHA512
94a56cda4b98e08935341b3366eb0d6d8058eea1274d161b3312c3aaf2dd2283d22d56e1d923159b10c84d77aca183a378fb4d016dbf179ae1c3afc63e03c61c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
260KB

MD5
ce2f773275d3fe8b78f4cf067d5e6a0f

SHA1
b7135e34d46eb4303147492d5cee5e1ef7b392ab

SHA256
eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d

SHA512
d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
108KB

MD5
4367bf64c5dd23b97f112d58a5c51a6e

SHA1
9c399a96e124217be85d420510275916ecd170ce

SHA256
82942de063ee93b8b8755fd3a69211e09c22614b50587e8c79c1d10d985186e5

SHA512
775fc13df10b92ab6c1846d2c68c81c6d70b0ad697b2eb0c4a16b509933c6ef142171438b29a07dd8136a736def48ad106b4a8e62adf7d89266d7f0cc22bb115

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
95KB

MD5
44e35b714d8eb73dc0a38e4989977d85

SHA1
09913bd3df943e2540da08e29aa5793f1a8f76c0

SHA256
76b58cbe6a79ea6f86a986e63056a1e8b8e542640d02d5b5e97779706761770d

SHA512
17ea71222c25c2d39694affdf61912b412524e7c5859fb72530ce805cd6cd4cd5744081383a907f0cde43bd95121719ab4479e4e62c1d7857460feb0c4c9b510

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
82KB

MD5
1cafcd2f3fad604d2a34acce0f6da448

SHA1
dbabe5776fa91ea1ff7a7fa7cf4bee8c81d5cf68

SHA256
c572889d5b73f60dffb02562c8a6d788ce5dd5c121ba9c863c266ab3cdf42bbf

SHA512
4223e15692681fc09c7a39347e5fa3aae59e6913eeb851fdc16b978275f1c3ccfe243b291acbcd97586c6e5b017fa1cad71bec4cb6e702020b7b030eb89bb08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
18KB

MD5
d09882d06576149dd510a482aee515f0

SHA1
d13c080c5644e30237af8e2e8684155952c92b0e

SHA256
b13315aeb23303ec46d7d8fb1d94d881e4d58c67e057f2c79104e4e5719e8201

SHA512
2ffe761a7f92f955464e2846763f2867c3e89ac9ee21978882bc995213a34902272e2ce3fcfb3e819c78fc48a60d75c5a3b726e85bc1960fe5a0ec73eeca38c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
26KB

MD5
ec554f2d84e7f794f828aa760be08d34

SHA1
72713a231eb9a8015d1c2ea3ac2f59e075f64a41

SHA256
5d7008bff9c31d365f01247c40a60a35d996a2071de5e9984626565b63a49fb8

SHA512
18ddf7a95ea96b4e494d17e579cd3862ce43ad75467f4753605bd73dd7429b0e395e75f11a9097488939cab5fc5a96406883f658b1f0ff9db014da65e4028da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
184KB

MD5
ecce077a4b7e22ccad9335cdaea0f9a4

SHA1
830d7e270d6cf131431ee4de6cc4f16120d325a3

SHA256
fbb1cec600c97399395cb1e40fd887cade4e745bb3940617426ac8fb37b5632e

SHA512
06818cda221c05818490de9db52e61fd5ff487780137f64a2b1450eb2be52984c4e11ae39330649cd31809984a5d93a9237b8dcd839c11f22b5f3382570d042b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

Filesize
112KB

MD5
6d4b2e73f6f8ecff02f19f7e8ef9a8c7

SHA1
09c32ca167136a17fd69df8c525ea5ffeca6c534

SHA256
fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

SHA512
2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
316KB

MD5
25b794b18bd8d03dc9530111cbce4173

SHA1
a6774d62bd1e9497fdfe6c61c495011fc6c274c6

SHA256
81757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4

SHA512
5892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
267KB

MD5
99bc6a791a230bae8d4c6816dbffaf80

SHA1
bd1cc94687d502dacb8e516f4c4af55a4963e5d7

SHA256
9a0b6c003856d420e0093d72d0f99dbb03e274c0a8cebc087ec299bbadcd0946

SHA512
c63d60257b6ed6ecdbc011505ac6956beed2d3f211f1c25953d4a3308509dbdc8266112df356e3a279358cc71819043ca8710832e5a315cf62ca983484755d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
255KB

MD5
897dc7b8d003290eb3161cb94bd9b1b1

SHA1
9bea4bc7bf91a54341b30c4b993697f6b7c22041

SHA256
5e693b0f92907dd62cdce9531ca713680a382abadcea7872b7bba17c2d4f3f90

SHA512
1f2000550e69bc096483922d8424edd899c8663b4c05f0c18895889f3a1f1fd7ce94ae1b0090870199f33657adfcb13dca5d2ab5be9746ab422a6cea3b3a0336

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
271KB

MD5
0b18ad13a61ed10b6f42ae38f8fdd26c

SHA1
aa3f4ef715dae154e761ae7ded9c1d239f97b542

SHA256
c7259a63a409a3d8c752882e5b3b052e0210b6e6f7f60821ab1a7b7d10e4814a

SHA512
af456300c233b8156aab63e88f086c7f9611d974bfacbf4823d98ef1f7ad13103959a015eb4b7d9ea354aa4aed92b2dc73c2e7025d00efecb4b0760b3e3e3953

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

Filesize
57KB

MD5
38e7c727e36dc4e16c83961abc7c505c

SHA1
ed2cab8c43caeeddb8372d39302719e1d9d67b13

SHA256
7727d96fefbec16b7fd5ab630372d9ebe57d7ea71e79dc38775b6748c73d88fd

SHA512
ac133b0185f746ee447ad8d0c36618a0ccd5446866829dd218ad1698640ece6154d5a69834faa816bf2c49d3e36e496c5426fbc8cacd16529ca58c7c7360afff

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

Filesize
165KB

MD5
2c23cf1f110c48ba1212a45c4983fd74

SHA1
35ed42ab7b247566ad979a6780a4a464466e5183

SHA256
d396f668792a5ecf8b70cda7922f71b3f077b77af618fab6c8df0270285ca085

SHA512
1536e0f5338ed9fb24e4c683e520dc9b60bdcaf8f0c3237f4583778705e5a53749d60247d350e09d1d0d00cc86db04626196109757ea4e63d52251d50509a1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

Filesize
180KB

MD5
56e9e121d68b5631a360d56b2ef4777f

SHA1
e9d11a2baf46769c90ee1671cd17072efd8cfb52

SHA256
c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f

SHA512
1ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
201KB

MD5
b4827cb71683dbb07a4a385ce607c13f

SHA1
2136ea294a8720b33aebc83083749e5d0368cea3

SHA256
621f848a8a96cbffa1a93e09eaaa369f7c88a5ed7f87dea2546792df4d2105ba

SHA512
c128cb104067a87c1d194fe1df61ad584b6f03d75fd3f84ac9c50a45dc8a8cce9db6a088744e5e230752c0645c6f11e749b94df1e392d87d61136ac58d8afd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
146KB

MD5
eac9cb2308dc15eb655be38598c68393

SHA1
59671ee293d942f8c060a717e6f355ef59c61fab

SHA256
ace0cc297c3ad519299730644fbd702ca10861979b84477dd06479cfc3a4bc89

SHA512
0ca615456d28625bda4ad35ce9e4dd8ec71c216e908f8dbbcb17a38840073c8858b4c2960b067aa21fadbbc3bdef4377ff39bf4a47555841e2b2d67db8f27b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
197KB

MD5
e447643141a6bfb3b775aef0e2d25c20

SHA1
9b63ea1e02ab4d916eb81d98194990e8699e61da

SHA256
5b5714c2f64b773287d8ffa6bc20a10dc981de6f84ed175c7b64e4a18cef0c6d

SHA512
71b1cbd6783c48023c0c12056ecaa3fbef1c7352671b17b72dd9a21ce79dc4bbeefe22c71f441a07f0621a06ba9d8dd5a829c0bbdefd790b5cba83e01b183e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
359KB

MD5
466cd676a3b5aeed2c2f79a50c4a953c

SHA1
e5d465eb9e6dae929515e99cafe4d2e785b33d50

SHA256
d7f06cc542d67399df46dc9c36c3a2cb033a4ced2242da3717ea0ad93ecf466d

SHA512
48a5ee3869e910738ded4d135e35f0af6b2ab79153a348d2f27f54878b9c697e4699e201c6c1a6b13122628eab03303511e9cd1a2aa39e486972fea1915d1673

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
1.0MB

MD5
1081d7eb7a17faedfa588b93fc85365e

SHA1
884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f

SHA256
0351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0

SHA512
1ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
261KB

MD5
a49c327d3b6134af875e77442285dd07

SHA1
99fb7a2d57cd497a10efbda7bf9d060966aa6a94

SHA256
fb5f45b8817d40672a31baa48520e39723a657b7b6c4f79ed9c0002e116cce22

SHA512
264406555b92adcea401d8372b26a89ce87ee24e8394cc13ff698c38dbce87c88cec92fbe2d4f52cf2bed5a859ae517ad9cffdbd1e85e6f5a197dceaa1ac1560

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\shell.fne

Filesize
40KB

MD5
d54753e7fc3ea03aec0181447969c0e8

SHA1
824e7007b6569ae36f174c146ae1b7242f98f734

SHA256
192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9

SHA512
c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

Filesize
46KB

MD5
7b87cad524c82b2f1eeb30f5fc497143

SHA1
9d52a3ff9340abe6ddd7c42db3f82f3257771244

SHA256
9b5986c79571cbbd346d33a54c39c1c7ae7c01b97f5a6d582702cf1ea5fa24bd

SHA512
259db772887612724b3907f241dcf9a51eb3fd483d8bbbc3983c705527d9f127ef8b2289da1ed4256f2779099c7ae84e49c19170f56a8bfa28cbd65ac9660e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

Filesize
72KB

MD5
c4337f54ceb6765fda33f96b8408c013

SHA1
242e447d71a346366526a721532b0d47d5d62239

SHA256
a3525832c5922696002c33ca8658a53a3bbcdd46a1e172ee1f5e815f037b7c08

SHA512
2bc2d4648b971f94e789815ce946578d412b585158056f10d2be147e194dfa8f4bd211eecb86b76aa78233da72b2544398945ca2850268109c6f3ef7e44a8c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

Filesize
57KB

MD5
0c9e1295647a45c4f32efba3996bc340

SHA1
aa97d6c0086ca3441d81c65cf9afc6684af57cf2

SHA256
b112877e8f6c690a01117fc49536484836e205805f3f6ace4743232852eb4933

SHA512
2ed51f117653e02d0c8c1bd7df94aefa51005cdb5f6d9de37dd114358ba9f32818f34c21909daaa08ffe69a00e01aec4b642e9135562d4e794a3bc03f83575da

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
818KB

MD5
523efec000506877434bf38c531d672c

SHA1
79c7b523969ebc262cfd590f4db83229edea13b1

SHA256
94934aa7af6dc0b87c66e39f99f984b3b77a3361f82a0bb50a8d23f5680bcc1a

SHA512
21d2fee78d47d593c9cbf700a06bbb005bd40dd20b6b63bcf0693743554daf219cc941c2d3ebebaccc4ee22f48d03f6cd717371d764b61163477b93cffa2de07

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
712KB

MD5
5b760880c70db2ec224d9227a28778d9

SHA1
91d4a18db0d8796f850c48c04f6a906dbea4e929

SHA256
58ab29e8dd715426e7b34178dd2da654a827725476d32c3f5968c428562c8008

SHA512
f64f2b3578c337355f928f04798059660568f7d3cf42911ef2f41da68c34415ffd97e95a9cee0e902de6ff4c65c0761ca0df0a372eec3189fb68f2128b2f776e

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
714KB

MD5
855b309726a1ed425d3a19a2d927bf71

SHA1
e533da6cac0f9e27ed988361de17dc492c9b0805

SHA256
e069b8330a98d49da9c056b5894d8c462d03e615be3cdac3f928a4db197eae04

SHA512
8b27307174539ac08b9f6ab8f3a4816e8e6af2fdc60dc38446c483d118bb611bfbf187900ff118797d91bdbab05a72e06755afda8ad965eabdf85967d4bd704b

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
228KB

MD5
a6c1fd25811a3865c63f9e197934c5c6

SHA1
4c963158f43e03583e69cf4389afc70780bc6b9a

SHA256
1c4104879b1bcc1f381265d9ca927332e87c7a2c12a29e3752158deb213bdade

SHA512
4488c6d0ad418374bb33eeb839ed33f7240592385c421865142db35724d4b47cd08347bfde2c820bef32f357d6ce1fec6fb7b96d17f98e731d842087cf665390

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
81KB

MD5
7ccaf8ff8811f8de490069936856f068

SHA1
bb835262defdc29e1aea233c66fb8f3c86df1c33

SHA256
a1e483131abafaa4d63daa7279109d4876f371ed2a7149a92029bfe9092b26de

SHA512
3960167298e4929becb58e45d50e38386d06ce30d26f49960d523691ab75c0ed30f91b23ab07e4751cc8bef726ac7f1b6f4b097dcd502de563b257378a845b7e

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
231KB

MD5
8dd7e08e379378d65d4255cb2270b6dd

SHA1
598ff121ea8e113e3d16f2d325f4bb830fb50e9a

SHA256
6a30ddbbde4e5bfc6c066a56407ae515aea24f8a99d077015dcc4525d7797be9

SHA512
3dfbaeb6b0937f5e2847951cc7a0c4d0d3d46f591183ffad8565db00fb7b82d4f0c72bcd7b76d4a33a1a67b802f4d03a04994f8cfd23da010663c0ef13be198b

Download Submit
memory/736-230-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/736-232-0x0000000002290000-0x00000000022DA000-memory.dmp

Filesize
296KB

Download
memory/736-263-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-439-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1480-402-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1584-28-0x0000000002FA0000-0x0000000002FB1000-memory.dmp

Filesize
68KB

Download
memory/1584-102-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1584-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1584-22-0x0000000002E70000-0x0000000002E8E000-memory.dmp

Filesize
120KB

Download
memory/1584-15-0x0000000002360000-0x00000000023AA000-memory.dmp

Filesize
296KB

Download
memory/2220-124-0x0000000002E80000-0x0000000002E91000-memory.dmp

Filesize
68KB

Download
memory/2220-151-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2220-113-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2220-116-0x0000000001FA0000-0x0000000001FEA000-memory.dmp

Filesize
296KB

Download
memory/2220-121-0x0000000002D40000-0x0000000002D5E000-memory.dmp

Filesize
120KB

Download
memory/2508-163-0x0000000002690000-0x00000000026AE000-memory.dmp

Filesize
120KB

Download
memory/2508-156-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2508-194-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2568-152-0x00000000021E0000-0x000000000222A000-memory.dmp

Filesize
296KB

Download
memory/2568-155-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download
memory/2568-154-0x00000000022B0000-0x00000000022CE000-memory.dmp

Filesize
120KB

Download
memory/2568-185-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3244-143-0x00000000021D0000-0x000000000221A000-memory.dmp

Filesize
296KB

Download
memory/3244-175-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3244-145-0x00000000024D0000-0x00000000024EE000-memory.dmp

Filesize
120KB

Download
memory/3244-146-0x00000000024F0000-0x0000000002501000-memory.dmp

Filesize
68KB

Download
memory/3296-220-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3296-253-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3616-214-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3616-184-0x00000000023B0000-0x00000000023C1000-memory.dmp

Filesize
68KB

Download
memory/3616-176-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3616-181-0x0000000002200000-0x000000000224A000-memory.dmp

Filesize
296KB

Download
memory/3616-183-0x0000000002370000-0x000000000238E000-memory.dmp

Filesize
120KB

Download
memory/3904-137-0x0000000002300000-0x000000000231E000-memory.dmp

Filesize
120KB

Download
memory/3904-133-0x00000000020D0000-0x000000000211A000-memory.dmp

Filesize
296KB

Download
memory/3904-171-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3904-138-0x0000000002E50000-0x0000000002E61000-memory.dmp

Filesize
68KB

Download
memory/4020-211-0x0000000002240000-0x000000000228A000-memory.dmp

Filesize
296KB

Download
memory/4020-206-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4020-213-0x0000000002D50000-0x0000000002D6E000-memory.dmp

Filesize
120KB

Download
memory/4020-215-0x0000000002D70000-0x0000000002D81000-memory.dmp

Filesize
68KB

Download
memory/4020-243-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4076-373-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4076-338-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4452-170-0x00000000022E0000-0x000000000232A000-memory.dmp

Filesize
296KB

Download
memory/4452-203-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4452-174-0x0000000002E60000-0x0000000002E71000-memory.dmp

Filesize
68KB

Download
memory/4452-169-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-136-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-98-0x0000000002D20000-0x0000000002D3E000-memory.dmp

Filesize
120KB

Download
memory/4492-82-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-101-0x0000000002E40000-0x0000000002E51000-memory.dmp

Filesize
68KB

Download
memory/4492-94-0x0000000001F90000-0x0000000001FDA000-memory.dmp

Filesize
296KB

Download
memory/4536-36-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4536-59-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/4536-55-0x00000000023F0000-0x000000000240E000-memory.dmp

Filesize
120KB

Download
memory/4536-118-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4536-50-0x00000000021C0000-0x000000000220A000-memory.dmp

Filesize
296KB

Download
memory/4568-70-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4568-73-0x0000000000600000-0x000000000064A000-memory.dmp

Filesize
296KB

Download
memory/4568-80-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/4568-77-0x0000000002170000-0x000000000218E000-memory.dmp

Filesize
120KB

Download
memory/4568-135-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4596-349-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4596-319-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4704-363-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4704-328-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4972-191-0x0000000002120000-0x000000000216A000-memory.dmp

Filesize
296KB

Download
memory/4972-193-0x00000000022C0000-0x00000000022DE000-memory.dmp

Filesize
120KB

Download
memory/4972-190-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4972-195-0x00000000023E0000-0x00000000023F1000-memory.dmp

Filesize
68KB

Download
memory/4972-221-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5108-200-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5108-204-0x0000000002D30000-0x0000000002D4E000-memory.dmp

Filesize
120KB

Download
memory/5108-201-0x0000000002110000-0x000000000215A000-memory.dmp

Filesize
296KB

Download
memory/5108-231-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5108-205-0x0000000002E70000-0x0000000002E81000-memory.dmp

Filesize
68KB

Download
memory/5136-301-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5140-273-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5140-240-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5316-274-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5316-246-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5376-308-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5376-341-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5488-275-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5488-260-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5564-348-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5564-380-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5656-368-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5656-400-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5696-270-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5696-313-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5724-422-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5724-396-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5724-333-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5724-294-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5996-389-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5996-358-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5996-314-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6032-412-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6092-410-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6292-413-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6508-427-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6660-436-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads