Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
Resource
win10v2004-20231215-en
General
-
Target
06631fd7bbbf9c0f7cd7527ff3a46b1f.exe
-
Size
1.2MB
-
MD5
06631fd7bbbf9c0f7cd7527ff3a46b1f
-
SHA1
a5df5fa915723c4166eaf02fb5f9dd280bf05ceb
-
SHA256
8c17b6f8c84d9743d224183cbf91dd710974aedbc3bd7f74e4ef493eec94e662
-
SHA512
b275ac195c1dc9fd06705a7089758a198a9a04e97df05e416367a258db2ef4a9957e7128429609b7dc0b368cc1a02f0d9b28422ef6fa2349f60ed543f5a792a1
-
SSDEEP
24576:so2ts4E59IrYnjtscr/dMYry/Zn1lTCvoKFmrj9G7yZlra2ST:U+9I6tssMYo/OvoNGqxavT
Malware Config
Signatures
-
Executes dropped EXE 12 IoCs
pid Process 4536 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 4452 XP-AB9DB5FA.EXE 3616 XP-AB9DB5FA.EXE 4972 explorer.exe 5108 XP-AB9DB5FA.EXE -
Loads dropped DLL 64 IoCs
pid Process 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE 4452 XP-AB9DB5FA.EXE -
Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE File opened for modification \??\PhysicalDrive0 explorer.exe File opened for modification \??\PhysicalDrive0 XP-AB9DB5FA.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\XP-AB9DB5FA.EXE Process not Found File opened for modification C:\Windows\SysWOW64\XP-AB9DB5FA.EXE Process not Found -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe -
Suspicious behavior: AddClipboardFormatListener 9 IoCs
pid Process 1388 explorer.exe 4524 explorer.exe 1484 explorer.exe 1352 explorer.exe 1652 explorer.exe 2256 explorer.exe 2696 explorer.exe 4004 explorer.exe 3456 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4536 XP-AB9DB5FA.EXE 4524 explorer.exe 4524 explorer.exe 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 4568 XP-AB9DB5FA.EXE 1388 explorer.exe 1388 explorer.exe 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 4492 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 1484 explorer.exe 1484 explorer.exe 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 2220 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 1352 explorer.exe 1352 explorer.exe 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 3904 XP-AB9DB5FA.EXE 1652 explorer.exe 1652 explorer.exe 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 3244 XP-AB9DB5FA.EXE 2256 explorer.exe 2256 explorer.exe 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2568 XP-AB9DB5FA.EXE 2696 explorer.exe 2696 explorer.exe 2508 XP-AB9DB5FA.EXE 2508 XP-AB9DB5FA.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2256 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 93 PID 1584 wrote to memory of 2256 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 93 PID 1584 wrote to memory of 2256 1584 06631fd7bbbf9c0f7cd7527ff3a46b1f.exe 93 PID 1584 wrote to memory of 4536 1584 Process not Found 95 PID 1584 wrote to memory of 4536 1584 Process not Found 95 PID 1584 wrote to memory of 4536 1584 Process not Found 95 PID 4536 wrote to memory of 3168 4536 XP-AB9DB5FA.EXE 101 PID 4536 wrote to memory of 3168 4536 XP-AB9DB5FA.EXE 101 PID 4536 wrote to memory of 3168 4536 XP-AB9DB5FA.EXE 101 PID 4536 wrote to memory of 4568 4536 XP-AB9DB5FA.EXE 96 PID 4536 wrote to memory of 4568 4536 XP-AB9DB5FA.EXE 96 PID 4536 wrote to memory of 4568 4536 XP-AB9DB5FA.EXE 96 PID 4568 wrote to memory of 1840 4568 XP-AB9DB5FA.EXE 98 PID 4568 wrote to memory of 1840 4568 XP-AB9DB5FA.EXE 98 PID 4568 wrote to memory of 1840 4568 XP-AB9DB5FA.EXE 98 PID 4568 wrote to memory of 4492 4568 XP-AB9DB5FA.EXE 99 PID 4568 wrote to memory of 4492 4568 XP-AB9DB5FA.EXE 99 PID 4568 wrote to memory of 4492 4568 XP-AB9DB5FA.EXE 99 PID 4492 wrote to memory of 5044 4492 XP-AB9DB5FA.EXE 107 PID 4492 wrote to memory of 5044 4492 XP-AB9DB5FA.EXE 107 PID 4492 wrote to memory of 5044 4492 XP-AB9DB5FA.EXE 107 PID 4492 wrote to memory of 2220 4492 XP-AB9DB5FA.EXE 106 PID 4492 wrote to memory of 2220 4492 XP-AB9DB5FA.EXE 106 PID 4492 wrote to memory of 2220 4492 XP-AB9DB5FA.EXE 106 PID 2220 wrote to memory of 4952 2220 XP-AB9DB5FA.EXE 103 PID 2220 wrote to memory of 4952 2220 XP-AB9DB5FA.EXE 103 PID 2220 wrote to memory of 4952 2220 XP-AB9DB5FA.EXE 103 PID 2220 wrote to memory of 3904 2220 XP-AB9DB5FA.EXE 105 PID 2220 wrote to memory of 3904 2220 XP-AB9DB5FA.EXE 105 PID 2220 wrote to memory of 3904 2220 XP-AB9DB5FA.EXE 105 PID 3904 wrote to memory of 4816 3904 XP-AB9DB5FA.EXE 108 PID 3904 wrote to memory of 4816 3904 XP-AB9DB5FA.EXE 108 PID 3904 wrote to memory of 4816 3904 XP-AB9DB5FA.EXE 108 PID 3904 wrote to memory of 3244 3904 XP-AB9DB5FA.EXE 110 PID 3904 wrote to memory of 3244 3904 XP-AB9DB5FA.EXE 110 PID 3904 wrote to memory of 3244 3904 XP-AB9DB5FA.EXE 110 PID 3244 wrote to memory of 3568 3244 XP-AB9DB5FA.EXE 113 PID 3244 wrote to memory of 3568 3244 XP-AB9DB5FA.EXE 113 PID 3244 wrote to memory of 3568 3244 XP-AB9DB5FA.EXE 113 PID 3244 wrote to memory of 2568 3244 XP-AB9DB5FA.EXE 112 PID 3244 wrote to memory of 2568 3244 XP-AB9DB5FA.EXE 112 PID 3244 wrote to memory of 2568 3244 XP-AB9DB5FA.EXE 112 PID 2568 wrote to memory of 3920 2568 XP-AB9DB5FA.EXE 114 PID 2568 wrote to memory of 3920 2568 XP-AB9DB5FA.EXE 114 PID 2568 wrote to memory of 3920 2568 XP-AB9DB5FA.EXE 114 PID 2568 wrote to memory of 2508 2568 XP-AB9DB5FA.EXE 115 PID 2568 wrote to memory of 2508 2568 XP-AB9DB5FA.EXE 115 PID 2568 wrote to memory of 2508 2568 XP-AB9DB5FA.EXE 115 PID 2508 wrote to memory of 1988 2508 XP-AB9DB5FA.EXE 118 PID 2508 wrote to memory of 1988 2508 XP-AB9DB5FA.EXE 118 PID 2508 wrote to memory of 1988 2508 XP-AB9DB5FA.EXE 118 PID 2508 wrote to memory of 4452 2508 XP-AB9DB5FA.EXE 119 PID 2508 wrote to memory of 4452 2508 XP-AB9DB5FA.EXE 119 PID 2508 wrote to memory of 4452 2508 XP-AB9DB5FA.EXE 119 PID 4452 wrote to memory of 820 4452 XP-AB9DB5FA.EXE 121 PID 4452 wrote to memory of 820 4452 XP-AB9DB5FA.EXE 121 PID 4452 wrote to memory of 820 4452 XP-AB9DB5FA.EXE 121 PID 4452 wrote to memory of 3616 4452 XP-AB9DB5FA.EXE 122 PID 4452 wrote to memory of 3616 4452 XP-AB9DB5FA.EXE 122 PID 4452 wrote to memory of 3616 4452 XP-AB9DB5FA.EXE 122 PID 3616 wrote to memory of 2764 3616 XP-AB9DB5FA.EXE 124 PID 3616 wrote to memory of 2764 3616 XP-AB9DB5FA.EXE 124 PID 3616 wrote to memory of 2764 3616 XP-AB9DB5FA.EXE 124 PID 3616 wrote to memory of 4972 3616 XP-AB9DB5FA.EXE 138
Processes
-
C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe"C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\06631fd7bbbf9c0f7cd7527ff3a46b1f2⤵PID:2256
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA4⤵PID:1840
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
-
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA5⤵PID:5044
-
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA3⤵PID:3168
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4524
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1388
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1484
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1352
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA1⤵PID:4952
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1652
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA2⤵PID:4816
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA4⤵PID:3920
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA5⤵PID:1988
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA6⤵PID:820
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA7⤵PID:2764
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE7⤵PID:4972
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA8⤵PID:1136
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE8⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA9⤵PID:4476
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE9⤵PID:4020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA10⤵PID:2816
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE10⤵PID:3296
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA11⤵PID:1908
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE11⤵PID:736
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA12⤵PID:3636
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE12⤵PID:5140
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA13⤵PID:5268
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE13⤵PID:5316
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA14⤵PID:5444
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE14⤵PID:5488
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA15⤵PID:5640
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE15⤵PID:5696
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA16⤵PID:5892
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE16⤵PID:5996
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA17⤵PID:1140
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE17⤵PID:5136
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA18⤵PID:4420
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE18⤵PID:5724
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA19⤵PID:5608
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE19⤵PID:5376
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA20⤵PID:3956
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE20⤵PID:4596
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA21⤵PID:576
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE21⤵PID:4704
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA22⤵PID:5072
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE22⤵PID:4076
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA23⤵PID:5868
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE23⤵PID:5564
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA24⤵PID:5808
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE24⤵PID:5996
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA25⤵PID:2928
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE25⤵PID:5656
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA26⤵PID:6036
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE26⤵PID:6092
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA27⤵PID:1764
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE27⤵PID:6032
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA28⤵PID:6112
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE28⤵PID:5724
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA29⤵PID:6064
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE29⤵PID:1480
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA30⤵PID:6220
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE30⤵PID:6292
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA31⤵PID:6456
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE31⤵PID:6508
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA32⤵PID:6624
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE32⤵PID:6660
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA33⤵PID:6796
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE33⤵PID:6836
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA34⤵PID:6984
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE34⤵PID:7020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA35⤵PID:5740
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE35⤵PID:576
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA36⤵PID:6524
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE36⤵PID:6460
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA37⤵PID:6624
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE37⤵PID:6904
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA38⤵PID:6520
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE38⤵PID:7004
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA39⤵PID:6880
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE39⤵PID:7108
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA40⤵PID:3528
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE40⤵PID:6664
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA41⤵PID:2408
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE41⤵PID:5288
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA42⤵PID:6612
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE42⤵PID:1280
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA43⤵PID:4548
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE43⤵PID:1444
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA44⤵PID:7192
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE44⤵PID:7236
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA45⤵PID:7380
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE45⤵PID:7416
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA46⤵PID:7556
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE46⤵PID:7612
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA47⤵PID:7936
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE47⤵PID:7968
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA48⤵PID:8156
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE48⤵PID:7188
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA49⤵PID:7196
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE49⤵PID:7464
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA50⤵PID:7852
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE50⤵PID:7420
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA51⤵PID:8164
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE51⤵PID:6432
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA52⤵PID:5344
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE52⤵PID:5720
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA53⤵PID:3956
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE53⤵PID:2620
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA54⤵PID:6812
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE54⤵PID:844
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA55⤵PID:4252
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE55⤵PID:7508
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA56⤵PID:7932
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE56⤵PID:7564
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA57⤵PID:6300
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE57⤵PID:4216
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA58⤵PID:7520
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE58⤵PID:6420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA3⤵PID:3568
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2256
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2696
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:4004
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:3456
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2200
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
PID:2488
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2796
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1952
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4972
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5148
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5332
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5496
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5704
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6124
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4472
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5144
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3080
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:392
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1932
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5492
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3032
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5752
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6104
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:552
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2196
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3420
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6304
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6540
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6668
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6872
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7028
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6372
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6488
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6296
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7148
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6624
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3052
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7112
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7248
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7424
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7632
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7976
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6328
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7528
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7996
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5248
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5544
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:6804
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7728
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:7664
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD56f5dab94c51140d0d9f83b8f8c27ab46
SHA14c3c7e9dee23e5870f2b86b9f44aee7ece1143ad
SHA25677e43da3c98ff72078af76ebb21cb8af699fc3a2d02124c837444bdba2ce89e5
SHA51228f310b27b4543fbdac684d9eee8761f030ca17bc84d0172a2718ffb6238b1cb7b0e2b43f8a5d7a516fdf94a8f48b489e5bf5c23151d6ca60a989ab689f7ca2c
-
Filesize
125KB
MD56685ba5e9544847165c3ef3c664ca134
SHA18b8d4608dba51c91157a08ffbc2b39625f2f6b00
SHA2565f13170a967c3caaafd1dad6086b0fd59c6928c219045f12f6772d39d50c0c51
SHA512e80d7d4cbb3dd24ddbe5c386b99d8d60614e47a2661d8e1fe67297adb988b3fe723b2e6596b9807af63c6accd076f914f5e29731b643c804c63d1e4006ebe910
-
Filesize
14KB
MD5955801c645fa7327952980b5dfce3bd6
SHA1c528451180d68f5c6c57a4ed01a459e1108b38cb
SHA25615806f8c76d185d433488128f61cad3cce014d09e0beba93822eadf5186ae78e
SHA512adfe87bf6e0c7c75c3cbfb4ff2b93afe506b761e418b96c92dcfa441c640b8a75667d483435f0aefabb16fe4dd9c654c6f4960e032214c1d09248665419ac5dc
-
Filesize
164KB
MD5a85d63acefa7a6fa639787e364c16892
SHA186ec32360c7ec9941b9411009de6aad0c83de46f
SHA256d0b26b744a94a6dc22eba1b79089c4e1f45db18a68a9b02f58f017b94873dcb8
SHA512fd12fbeab738358b47836badaf635511ea819fb5a35de4065b68d9b6f7e0f5eb443a7363164f32e8308701e78f2279c9c481038d09a2aa92a4ec184a91a2b9e8
-
Filesize
133KB
MD5f1faa8f5dbc62d208293ee450be60568
SHA13e06c68b4afb6c6e08cf2d5b64e9cc1f54a4aec2
SHA25641934d41fc71f66e1a897e23b909b6db6a6ada28267326ab652a161ed58919b0
SHA51294a56cda4b98e08935341b3366eb0d6d8058eea1274d161b3312c3aaf2dd2283d22d56e1d923159b10c84d77aca183a378fb4d016dbf179ae1c3afc63e03c61c
-
Filesize
260KB
MD5ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063
-
Filesize
108KB
MD54367bf64c5dd23b97f112d58a5c51a6e
SHA19c399a96e124217be85d420510275916ecd170ce
SHA25682942de063ee93b8b8755fd3a69211e09c22614b50587e8c79c1d10d985186e5
SHA512775fc13df10b92ab6c1846d2c68c81c6d70b0ad697b2eb0c4a16b509933c6ef142171438b29a07dd8136a736def48ad106b4a8e62adf7d89266d7f0cc22bb115
-
Filesize
95KB
MD544e35b714d8eb73dc0a38e4989977d85
SHA109913bd3df943e2540da08e29aa5793f1a8f76c0
SHA25676b58cbe6a79ea6f86a986e63056a1e8b8e542640d02d5b5e97779706761770d
SHA51217ea71222c25c2d39694affdf61912b412524e7c5859fb72530ce805cd6cd4cd5744081383a907f0cde43bd95121719ab4479e4e62c1d7857460feb0c4c9b510
-
Filesize
82KB
MD51cafcd2f3fad604d2a34acce0f6da448
SHA1dbabe5776fa91ea1ff7a7fa7cf4bee8c81d5cf68
SHA256c572889d5b73f60dffb02562c8a6d788ce5dd5c121ba9c863c266ab3cdf42bbf
SHA5124223e15692681fc09c7a39347e5fa3aae59e6913eeb851fdc16b978275f1c3ccfe243b291acbcd97586c6e5b017fa1cad71bec4cb6e702020b7b030eb89bb08d
-
Filesize
18KB
MD5d09882d06576149dd510a482aee515f0
SHA1d13c080c5644e30237af8e2e8684155952c92b0e
SHA256b13315aeb23303ec46d7d8fb1d94d881e4d58c67e057f2c79104e4e5719e8201
SHA5122ffe761a7f92f955464e2846763f2867c3e89ac9ee21978882bc995213a34902272e2ce3fcfb3e819c78fc48a60d75c5a3b726e85bc1960fe5a0ec73eeca38c6
-
Filesize
26KB
MD5ec554f2d84e7f794f828aa760be08d34
SHA172713a231eb9a8015d1c2ea3ac2f59e075f64a41
SHA2565d7008bff9c31d365f01247c40a60a35d996a2071de5e9984626565b63a49fb8
SHA51218ddf7a95ea96b4e494d17e579cd3862ce43ad75467f4753605bd73dd7429b0e395e75f11a9097488939cab5fc5a96406883f658b1f0ff9db014da65e4028da8
-
Filesize
184KB
MD5ecce077a4b7e22ccad9335cdaea0f9a4
SHA1830d7e270d6cf131431ee4de6cc4f16120d325a3
SHA256fbb1cec600c97399395cb1e40fd887cade4e745bb3940617426ac8fb37b5632e
SHA51206818cda221c05818490de9db52e61fd5ff487780137f64a2b1450eb2be52984c4e11ae39330649cd31809984a5d93a9237b8dcd839c11f22b5f3382570d042b
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
316KB
MD525b794b18bd8d03dc9530111cbce4173
SHA1a6774d62bd1e9497fdfe6c61c495011fc6c274c6
SHA25681757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4
SHA5125892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac
-
Filesize
267KB
MD599bc6a791a230bae8d4c6816dbffaf80
SHA1bd1cc94687d502dacb8e516f4c4af55a4963e5d7
SHA2569a0b6c003856d420e0093d72d0f99dbb03e274c0a8cebc087ec299bbadcd0946
SHA512c63d60257b6ed6ecdbc011505ac6956beed2d3f211f1c25953d4a3308509dbdc8266112df356e3a279358cc71819043ca8710832e5a315cf62ca983484755d02
-
Filesize
255KB
MD5897dc7b8d003290eb3161cb94bd9b1b1
SHA19bea4bc7bf91a54341b30c4b993697f6b7c22041
SHA2565e693b0f92907dd62cdce9531ca713680a382abadcea7872b7bba17c2d4f3f90
SHA5121f2000550e69bc096483922d8424edd899c8663b4c05f0c18895889f3a1f1fd7ce94ae1b0090870199f33657adfcb13dca5d2ab5be9746ab422a6cea3b3a0336
-
Filesize
271KB
MD50b18ad13a61ed10b6f42ae38f8fdd26c
SHA1aa3f4ef715dae154e761ae7ded9c1d239f97b542
SHA256c7259a63a409a3d8c752882e5b3b052e0210b6e6f7f60821ab1a7b7d10e4814a
SHA512af456300c233b8156aab63e88f086c7f9611d974bfacbf4823d98ef1f7ad13103959a015eb4b7d9ea354aa4aed92b2dc73c2e7025d00efecb4b0760b3e3e3953
-
Filesize
57KB
MD538e7c727e36dc4e16c83961abc7c505c
SHA1ed2cab8c43caeeddb8372d39302719e1d9d67b13
SHA2567727d96fefbec16b7fd5ab630372d9ebe57d7ea71e79dc38775b6748c73d88fd
SHA512ac133b0185f746ee447ad8d0c36618a0ccd5446866829dd218ad1698640ece6154d5a69834faa816bf2c49d3e36e496c5426fbc8cacd16529ca58c7c7360afff
-
Filesize
165KB
MD52c23cf1f110c48ba1212a45c4983fd74
SHA135ed42ab7b247566ad979a6780a4a464466e5183
SHA256d396f668792a5ecf8b70cda7922f71b3f077b77af618fab6c8df0270285ca085
SHA5121536e0f5338ed9fb24e4c683e520dc9b60bdcaf8f0c3237f4583778705e5a53749d60247d350e09d1d0d00cc86db04626196109757ea4e63d52251d50509a1b8
-
Filesize
180KB
MD556e9e121d68b5631a360d56b2ef4777f
SHA1e9d11a2baf46769c90ee1671cd17072efd8cfb52
SHA256c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f
SHA5121ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e
-
Filesize
201KB
MD5b4827cb71683dbb07a4a385ce607c13f
SHA12136ea294a8720b33aebc83083749e5d0368cea3
SHA256621f848a8a96cbffa1a93e09eaaa369f7c88a5ed7f87dea2546792df4d2105ba
SHA512c128cb104067a87c1d194fe1df61ad584b6f03d75fd3f84ac9c50a45dc8a8cce9db6a088744e5e230752c0645c6f11e749b94df1e392d87d61136ac58d8afd2c
-
Filesize
146KB
MD5eac9cb2308dc15eb655be38598c68393
SHA159671ee293d942f8c060a717e6f355ef59c61fab
SHA256ace0cc297c3ad519299730644fbd702ca10861979b84477dd06479cfc3a4bc89
SHA5120ca615456d28625bda4ad35ce9e4dd8ec71c216e908f8dbbcb17a38840073c8858b4c2960b067aa21fadbbc3bdef4377ff39bf4a47555841e2b2d67db8f27b9a
-
Filesize
197KB
MD5e447643141a6bfb3b775aef0e2d25c20
SHA19b63ea1e02ab4d916eb81d98194990e8699e61da
SHA2565b5714c2f64b773287d8ffa6bc20a10dc981de6f84ed175c7b64e4a18cef0c6d
SHA51271b1cbd6783c48023c0c12056ecaa3fbef1c7352671b17b72dd9a21ce79dc4bbeefe22c71f441a07f0621a06ba9d8dd5a829c0bbdefd790b5cba83e01b183e8b
-
Filesize
359KB
MD5466cd676a3b5aeed2c2f79a50c4a953c
SHA1e5d465eb9e6dae929515e99cafe4d2e785b33d50
SHA256d7f06cc542d67399df46dc9c36c3a2cb033a4ced2242da3717ea0ad93ecf466d
SHA51248a5ee3869e910738ded4d135e35f0af6b2ab79153a348d2f27f54878b9c697e4699e201c6c1a6b13122628eab03303511e9cd1a2aa39e486972fea1915d1673
-
Filesize
1.0MB
MD51081d7eb7a17faedfa588b93fc85365e
SHA1884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f
SHA2560351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0
SHA5121ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81
-
Filesize
261KB
MD5a49c327d3b6134af875e77442285dd07
SHA199fb7a2d57cd497a10efbda7bf9d060966aa6a94
SHA256fb5f45b8817d40672a31baa48520e39723a657b7b6c4f79ed9c0002e116cce22
SHA512264406555b92adcea401d8372b26a89ce87ee24e8394cc13ff698c38dbce87c88cec92fbe2d4f52cf2bed5a859ae517ad9cffdbd1e85e6f5a197dceaa1ac1560
-
Filesize
40KB
MD5d54753e7fc3ea03aec0181447969c0e8
SHA1824e7007b6569ae36f174c146ae1b7242f98f734
SHA256192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9
SHA512c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f
-
Filesize
46KB
MD57b87cad524c82b2f1eeb30f5fc497143
SHA19d52a3ff9340abe6ddd7c42db3f82f3257771244
SHA2569b5986c79571cbbd346d33a54c39c1c7ae7c01b97f5a6d582702cf1ea5fa24bd
SHA512259db772887612724b3907f241dcf9a51eb3fd483d8bbbc3983c705527d9f127ef8b2289da1ed4256f2779099c7ae84e49c19170f56a8bfa28cbd65ac9660e0e
-
Filesize
72KB
MD5c4337f54ceb6765fda33f96b8408c013
SHA1242e447d71a346366526a721532b0d47d5d62239
SHA256a3525832c5922696002c33ca8658a53a3bbcdd46a1e172ee1f5e815f037b7c08
SHA5122bc2d4648b971f94e789815ce946578d412b585158056f10d2be147e194dfa8f4bd211eecb86b76aa78233da72b2544398945ca2850268109c6f3ef7e44a8c9c
-
Filesize
57KB
MD50c9e1295647a45c4f32efba3996bc340
SHA1aa97d6c0086ca3441d81c65cf9afc6684af57cf2
SHA256b112877e8f6c690a01117fc49536484836e205805f3f6ace4743232852eb4933
SHA5122ed51f117653e02d0c8c1bd7df94aefa51005cdb5f6d9de37dd114358ba9f32818f34c21909daaa08ffe69a00e01aec4b642e9135562d4e794a3bc03f83575da
-
Filesize
818KB
MD5523efec000506877434bf38c531d672c
SHA179c7b523969ebc262cfd590f4db83229edea13b1
SHA25694934aa7af6dc0b87c66e39f99f984b3b77a3361f82a0bb50a8d23f5680bcc1a
SHA51221d2fee78d47d593c9cbf700a06bbb005bd40dd20b6b63bcf0693743554daf219cc941c2d3ebebaccc4ee22f48d03f6cd717371d764b61163477b93cffa2de07
-
Filesize
712KB
MD55b760880c70db2ec224d9227a28778d9
SHA191d4a18db0d8796f850c48c04f6a906dbea4e929
SHA25658ab29e8dd715426e7b34178dd2da654a827725476d32c3f5968c428562c8008
SHA512f64f2b3578c337355f928f04798059660568f7d3cf42911ef2f41da68c34415ffd97e95a9cee0e902de6ff4c65c0761ca0df0a372eec3189fb68f2128b2f776e
-
Filesize
714KB
MD5855b309726a1ed425d3a19a2d927bf71
SHA1e533da6cac0f9e27ed988361de17dc492c9b0805
SHA256e069b8330a98d49da9c056b5894d8c462d03e615be3cdac3f928a4db197eae04
SHA5128b27307174539ac08b9f6ab8f3a4816e8e6af2fdc60dc38446c483d118bb611bfbf187900ff118797d91bdbab05a72e06755afda8ad965eabdf85967d4bd704b
-
Filesize
228KB
MD5a6c1fd25811a3865c63f9e197934c5c6
SHA14c963158f43e03583e69cf4389afc70780bc6b9a
SHA2561c4104879b1bcc1f381265d9ca927332e87c7a2c12a29e3752158deb213bdade
SHA5124488c6d0ad418374bb33eeb839ed33f7240592385c421865142db35724d4b47cd08347bfde2c820bef32f357d6ce1fec6fb7b96d17f98e731d842087cf665390
-
Filesize
81KB
MD57ccaf8ff8811f8de490069936856f068
SHA1bb835262defdc29e1aea233c66fb8f3c86df1c33
SHA256a1e483131abafaa4d63daa7279109d4876f371ed2a7149a92029bfe9092b26de
SHA5123960167298e4929becb58e45d50e38386d06ce30d26f49960d523691ab75c0ed30f91b23ab07e4751cc8bef726ac7f1b6f4b097dcd502de563b257378a845b7e
-
Filesize
231KB
MD58dd7e08e379378d65d4255cb2270b6dd
SHA1598ff121ea8e113e3d16f2d325f4bb830fb50e9a
SHA2566a30ddbbde4e5bfc6c066a56407ae515aea24f8a99d077015dcc4525d7797be9
SHA5123dfbaeb6b0937f5e2847951cc7a0c4d0d3d46f591183ffad8565db00fb7b82d4f0c72bcd7b76d4a33a1a67b802f4d03a04994f8cfd23da010663c0ef13be198b