c753fa19a5b18c01b5be44df820a2ccb3afd70d71c7ae83aae8af89126d81ebc

Analysis

max time kernel
6s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c1baf037252dda5e8a122e1a6a2d50.exe
Size

1.2MB
MD5

36c1baf037252dda5e8a122e1a6a2d50
SHA1

84372a8e5ba9226113ae332ccd7066b97a866e54
SHA256

c753fa19a5b18c01b5be44df820a2ccb3afd70d71c7ae83aae8af89126d81ebc
SHA512

73844701443d35428e1a1a9cf17a39672fac15d78915acac0edfc02e934a7b2ce791042520b16c1cfb572add207e99fbe01bf5912e0587d7725ed559203cf508
SSDEEP

24576:VcyT/nPdHXT3SDkPHy01tpaQNDMAj444zi8FERepdUD/xD/hRuJ6:SyrdeDkPS01t5NDMAj444zXGOS/RZRuY

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	36c1baf037252dda5e8a122e1a6a2d50.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe
3576	36c1baf037252dda5e8a122e1a6a2d50.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4392	3576	36c1baf037252dda5e8a122e1a6a2d50.exe	91
PID 3576 wrote to memory of 4392	3576	36c1baf037252dda5e8a122e1a6a2d50.exe	91
PID 3576 wrote to memory of 4392	3576	36c1baf037252dda5e8a122e1a6a2d50.exe	91

C:\Users\Admin\AppData\Local\Temp\36c1baf037252dda5e8a122e1a6a2d50.exe
"C:\Users\Admin\AppData\Local\Temp\36c1baf037252dda5e8a122e1a6a2d50.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\36c1baf037252dda5e8a122e1a6a2d50
  2⤵
  PID:4392
- C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
  C:\Windows\system32\XP-AB9DB5FA.EXE
  2⤵
  PID:5044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2116

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:5056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2176

C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
C:\Windows\system32\XP-AB9DB5FA.EXE
1⤵
PID:4212
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
  2⤵
  PID:496
- C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
  C:\Windows\system32\XP-AB9DB5FA.EXE
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
    C:\Windows\system32\XP-AB9DB5FA.EXE
    3⤵
    PID:2000
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
      4⤵
      PID:376
  - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
      C:\Windows\system32\XP-AB9DB5FA.EXE
      4⤵
      PID:4492
    - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        5⤵
        
        PID:3464
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        6⤵
        
        PID:4460
      - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        6⤵
        
        PID:768
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        7⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        7⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        8⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        8⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        9⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        9⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        10⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        10⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        11⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        11⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        12⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        12⤵
        
        PID:1580
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
    3⤵
    PID:4944

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4592

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:2292

C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
C:\Windows\system32\XP-AB9DB5FA.EXE
1⤵
PID:2324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2692

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:3832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2768

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3948

C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
C:\Windows\system32\XP-AB9DB5FA.EXE
1⤵
PID:2956
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
  2⤵
  PID:5200
- C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
  C:\Windows\system32\XP-AB9DB5FA.EXE
  2⤵
  PID:5264
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
    C:\Windows\system32\XP-AB9DB5FA.EXE
    3⤵
    PID:5444
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
      4⤵
      PID:5572
  - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
      C:\Windows\system32\XP-AB9DB5FA.EXE
      4⤵
      PID:5620
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        5⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        5⤵
        
        PID:5808
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        6⤵
        
        PID:6076
      - C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        6⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        7⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        7⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        8⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        9⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        9⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        10⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        10⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        11⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        11⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        12⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        12⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        13⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        13⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        14⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        14⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        13⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        13⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        14⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        14⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        15⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        15⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        16⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        16⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        17⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        17⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        18⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        18⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        19⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        19⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        20⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        20⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        21⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        21⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        22⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        23⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        23⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        24⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        24⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        25⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        25⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        26⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        26⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        27⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        27⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        28⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        28⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        29⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        29⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        30⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        30⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        31⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        31⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        32⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        32⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        33⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        33⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        34⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        34⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        35⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        35⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        36⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        36⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        37⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        37⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        38⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        38⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        39⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        39⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        40⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        40⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        41⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        41⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        42⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        42⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        43⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        43⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        44⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        44⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        45⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        45⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        46⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        46⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        47⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        47⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        48⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        48⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        49⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        49⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        50⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        50⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        51⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        51⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        52⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        52⤵
        
        PID:564
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        53⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        53⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        54⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        54⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        55⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        56⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        56⤵
        
        PID:680
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        57⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        57⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        58⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        58⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        59⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        59⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        60⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        60⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        61⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        61⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        62⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        62⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        63⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        63⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        64⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        64⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        65⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        65⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        66⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        66⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        67⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        67⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        68⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        68⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        69⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        69⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        70⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        70⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        71⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        71⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        72⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        72⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        73⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        73⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        74⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        74⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        75⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        75⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        76⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        76⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        77⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        
        C:\Windows\system32\XP-AB9DB5FA.EXE
        77⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        55⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
        8⤵
        
        PID:5568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5620

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7072

C:\Windows\SysWOW64\explorer.exe
explorer C:\Windows\SysWOW64\XP-AB9DB5FA
1⤵
PID:6352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7032

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8024

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9564

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fne

Filesize
164KB

MD5
a85d63acefa7a6fa639787e364c16892

SHA1
86ec32360c7ec9941b9411009de6aad0c83de46f

SHA256
d0b26b744a94a6dc22eba1b79089c4e1f45db18a68a9b02f58f017b94873dcb8

SHA512
fd12fbeab738358b47836badaf635511ea819fb5a35de4065b68d9b6f7e0f5eb443a7363164f32e8308701e78f2279c9c481038d09a2aa92a4ec184a91a2b9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
260KB

MD5
ce2f773275d3fe8b78f4cf067d5e6a0f

SHA1
b7135e34d46eb4303147492d5cee5e1ef7b392ab

SHA256
eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d

SHA512
d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

Filesize
112KB

MD5
6d4b2e73f6f8ecff02f19f7e8ef9a8c7

SHA1
09c32ca167136a17fd69df8c525ea5ffeca6c534

SHA256
fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

SHA512
2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
316KB

MD5
25b794b18bd8d03dc9530111cbce4173

SHA1
a6774d62bd1e9497fdfe6c61c495011fc6c274c6

SHA256
81757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4

SHA512
5892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

Filesize
180KB

MD5
56e9e121d68b5631a360d56b2ef4777f

SHA1
e9d11a2baf46769c90ee1671cd17072efd8cfb52

SHA256
c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f

SHA512
1ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
1.0MB

MD5
1081d7eb7a17faedfa588b93fc85365e

SHA1
884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f

SHA256
0351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0

SHA512
1ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\shell.fne

Filesize
40KB

MD5
d54753e7fc3ea03aec0181447969c0e8

SHA1
824e7007b6569ae36f174c146ae1b7242f98f734

SHA256
192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9

SHA512
c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

Filesize
72KB

MD5
c4337f54ceb6765fda33f96b8408c013

SHA1
242e447d71a346366526a721532b0d47d5d62239

SHA256
a3525832c5922696002c33ca8658a53a3bbcdd46a1e172ee1f5e815f037b7c08

SHA512
2bc2d4648b971f94e789815ce946578d412b585158056f10d2be147e194dfa8f4bd211eecb86b76aa78233da72b2544398945ca2850268109c6f3ef7e44a8c9c

Download Submit
C:\Windows\SysWOW64\XP-AB9DB5FA.EXE

Filesize
1.2MB

MD5
36c1baf037252dda5e8a122e1a6a2d50

SHA1
84372a8e5ba9226113ae332ccd7066b97a866e54

SHA256
c753fa19a5b18c01b5be44df820a2ccb3afd70d71c7ae83aae8af89126d81ebc

SHA512
73844701443d35428e1a1a9cf17a39672fac15d78915acac0edfc02e934a7b2ce791042520b16c1cfb572add207e99fbe01bf5912e0587d7725ed559203cf508

Download Submit
memory/768-191-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/768-164-0x0000000002240000-0x000000000225E000-memory.dmp

Filesize
120KB

Download
memory/768-162-0x0000000002040000-0x000000000208A000-memory.dmp

Filesize
296KB

Download
memory/1580-251-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1580-221-0x0000000002020000-0x000000000206A000-memory.dmp

Filesize
296KB

Download
memory/1580-224-0x0000000002D40000-0x0000000002D51000-memory.dmp

Filesize
68KB

Download
memory/1580-216-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1580-223-0x0000000002D20000-0x0000000002D3E000-memory.dmp

Filesize
120KB

Download
memory/1772-118-0x00000000024C0000-0x00000000024DE000-memory.dmp

Filesize
120KB

Download
memory/1772-102-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-121-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download
memory/1772-152-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1992-449-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2000-127-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2000-161-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2000-137-0x00000000023C0000-0x00000000023DE000-memory.dmp

Filesize
120KB

Download
memory/2000-138-0x0000000002400000-0x0000000002411000-memory.dmp

Filesize
68KB

Download
memory/2324-79-0x0000000002D60000-0x0000000002D71000-memory.dmp

Filesize
68KB

Download
memory/2324-76-0x0000000002340000-0x000000000235E000-memory.dmp

Filesize
120KB

Download
memory/2324-124-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2324-72-0x0000000002120000-0x000000000216A000-memory.dmp

Filesize
296KB

Download
memory/2544-204-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-193-0x0000000002540000-0x000000000255E000-memory.dmp

Filesize
120KB

Download
memory/2544-194-0x00000000026F0000-0x0000000002701000-memory.dmp

Filesize
68KB

Download
memory/2544-190-0x00000000021E0000-0x000000000222A000-memory.dmp

Filesize
296KB

Download
memory/2936-288-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2936-325-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2956-233-0x0000000002E70000-0x0000000002E81000-memory.dmp

Filesize
68KB

Download
memory/2956-258-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2956-225-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2956-230-0x0000000002030000-0x000000000207A000-memory.dmp

Filesize
296KB

Download
memory/2956-232-0x0000000002300000-0x000000000231E000-memory.dmp

Filesize
120KB

Download
memory/3056-176-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-203-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-184-0x00000000023B0000-0x00000000023CE000-memory.dmp

Filesize
120KB

Download
memory/3056-185-0x00000000023F0000-0x0000000002401000-memory.dmp

Filesize
68KB

Download
memory/3056-181-0x0000000002210000-0x000000000225A000-memory.dmp

Filesize
296KB

Download
memory/3464-155-0x0000000002200000-0x000000000221E000-memory.dmp

Filesize
120KB

Download
memory/3464-156-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/3464-183-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3464-153-0x0000000002130000-0x000000000217A000-memory.dmp

Filesize
296KB

Download
memory/3576-28-0x0000000002630000-0x0000000002641000-memory.dmp

Filesize
68KB

Download
memory/3576-22-0x0000000002500000-0x000000000251E000-memory.dmp

Filesize
120KB

Download
memory/3576-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3576-123-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3576-15-0x0000000002260000-0x00000000022AA000-memory.dmp

Filesize
296KB

Download
memory/4212-97-0x00000000026A0000-0x00000000026BE000-memory.dmp

Filesize
120KB

Download
memory/4212-100-0x0000000002E60000-0x0000000002E71000-memory.dmp

Filesize
68KB

Download
memory/4212-81-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4212-125-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4212-93-0x0000000001FB0000-0x0000000001FFA000-memory.dmp

Filesize
296KB

Download
memory/4256-297-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4256-335-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-173-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4492-144-0x0000000002350000-0x000000000239A000-memory.dmp

Filesize
296KB

Download
memory/4492-146-0x0000000002510000-0x000000000252E000-memory.dmp

Filesize
120KB

Download
memory/4640-213-0x00000000021A0000-0x00000000021BE000-memory.dmp

Filesize
120KB

Download
memory/4640-211-0x0000000001F80000-0x0000000001FCA000-memory.dmp

Filesize
296KB

Download
memory/4640-215-0x00000000023C0000-0x00000000023D1000-memory.dmp

Filesize
68KB

Download
memory/4640-214-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4708-170-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4708-195-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4708-171-0x00000000021F0000-0x000000000223A000-memory.dmp

Filesize
296KB

Download
memory/4708-339-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4708-174-0x0000000002310000-0x000000000232E000-memory.dmp

Filesize
120KB

Download
memory/4708-175-0x0000000002540000-0x0000000002551000-memory.dmp

Filesize
68KB

Download
memory/4944-242-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4944-196-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4944-206-0x0000000002E80000-0x0000000002E91000-memory.dmp

Filesize
68KB

Download
memory/5044-36-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5044-59-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/5044-50-0x00000000021A0000-0x00000000021EA000-memory.dmp

Filesize
296KB

Download
memory/5044-55-0x0000000002420000-0x000000000243E000-memory.dmp

Filesize
120KB

Download
memory/5044-122-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5264-234-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5264-267-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5412-324-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5412-343-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5412-384-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5412-340-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5444-244-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5444-271-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5620-272-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5624-306-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5624-338-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5808-268-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5808-281-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6052-334-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6052-350-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6052-357-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6052-387-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6104-444-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6120-317-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6260-410-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6260-446-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6288-388-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6420-389-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6420-374-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6464-432-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6644-417-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6644-383-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6896-435-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6896-392-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7084-401-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7084-438-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads