Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 10:45
Behavioral task
behavioral1
Sample
c5ad35303d1ffad33cc1e0149b9944df.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c5ad35303d1ffad33cc1e0149b9944df.exe
Resource
win10v2004-20240226-en
General
-
Target
c5ad35303d1ffad33cc1e0149b9944df.exe
-
Size
45KB
-
MD5
c5ad35303d1ffad33cc1e0149b9944df
-
SHA1
fc4a3308f089804f24adaa0852ab57ac8e2b13d4
-
SHA256
44310c7190866c75e9e1b11adf2e5024ea48c90230b6737e5aca7d6667600f57
-
SHA512
457a82a5f8d9f065cf819901bdcdeae90d5cec8ec6d191c9b4b717f7417b937c17d5c66ca62125a8284d857420182a66bf1b101ea454cd62aafd0eac6435bea3
-
SSDEEP
768:QLQYBHWBRmiYlg+RA+sT4+AxHelme8IdezhYvl62MzXO40jc07wNR:vYloR5l+RXshGHel8+vDMb10c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 48 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation c5ad35303d1ffad33cc1e0149b9944df.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SPLOPE.exe -
Executes dropped EXE 48 IoCs
pid Process 2920 SPLOPE.exe 3560 SPLOPE.exe 1656 SPLOPE.exe 3092 SPLOPE.exe 2952 SPLOPE.exe 2936 SPLOPE.exe 4924 SPLOPE.exe 2352 SPLOPE.exe 3612 SPLOPE.exe 2336 SPLOPE.exe 3356 SPLOPE.exe 4964 SPLOPE.exe 1708 SPLOPE.exe 4064 SPLOPE.exe 1920 SPLOPE.exe 3988 SPLOPE.exe 4296 SPLOPE.exe 2008 SPLOPE.exe 456 SPLOPE.exe 4528 SPLOPE.exe 3556 SPLOPE.exe 2368 SPLOPE.exe 3604 SPLOPE.exe 916 SPLOPE.exe 2016 SPLOPE.exe 496 SPLOPE.exe 2172 SPLOPE.exe 388 SPLOPE.exe 4920 SPLOPE.exe 1132 SPLOPE.exe 2732 SPLOPE.exe 4296 SPLOPE.exe 4004 SPLOPE.exe 4544 SPLOPE.exe 2620 SPLOPE.exe 1656 SPLOPE.exe 3164 SPLOPE.exe 4992 SPLOPE.exe 2608 SPLOPE.exe 5036 SPLOPE.exe 3676 SPLOPE.exe 4264 SPLOPE.exe 916 SPLOPE.exe 3080 SPLOPE.exe 3752 SPLOPE.exe 4264 SPLOPE.exe 3588 SPLOPE.exe 4320 SPLOPE.exe -
resource yara_rule behavioral2/memory/4684-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x000700000002324a-4.dat upx behavioral2/memory/4684-6-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2920-10-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1656-14-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3560-15-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1656-19-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3092-23-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2936-27-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2952-28-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2936-32-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4924-36-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2352-40-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2336-44-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3612-45-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3356-49-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2336-50-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3356-54-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1708-58-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4964-59-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4064-63-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1708-64-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4064-68-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1920-72-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3988-76-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4296-80-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2008-84-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/456-88-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4528-92-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3556-96-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2368-100-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3604-104-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/916-108-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2016-112-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/496-116-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2172-120-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/388-124-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1132-128-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4920-129-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1132-133-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2732-137-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4296-139-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4544-141-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4004-142-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4544-144-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2620-146-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3164-148-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/1656-149-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3164-151-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4992-153-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2608-155-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/5036-157-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3676-159-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4264-161-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/916-163-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3080-165-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3752-167-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4264-169-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/3588-172-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4320-174-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4620-176-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/452-178-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/5068-180-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4180-182-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Adds Run key to start application 2 TTPs 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" c5ad35303d1ffad33cc1e0149b9944df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.dat c5ad35303d1ffad33cc1e0149b9944df.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe c5ad35303d1ffad33cc1e0149b9944df.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3588 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 95 PID 4684 wrote to memory of 3588 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 95 PID 4684 wrote to memory of 3588 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 95 PID 3588 wrote to memory of 3628 3588 net.exe 98 PID 3588 wrote to memory of 3628 3588 net.exe 98 PID 3588 wrote to memory of 3628 3588 net.exe 98 PID 4684 wrote to memory of 2920 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 100 PID 4684 wrote to memory of 2920 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 100 PID 4684 wrote to memory of 2920 4684 c5ad35303d1ffad33cc1e0149b9944df.exe 100 PID 2920 wrote to memory of 4860 2920 SPLOPE.exe 102 PID 2920 wrote to memory of 4860 2920 SPLOPE.exe 102 PID 2920 wrote to memory of 4860 2920 SPLOPE.exe 102 PID 2920 wrote to memory of 3560 2920 SPLOPE.exe 104 PID 2920 wrote to memory of 3560 2920 SPLOPE.exe 104 PID 2920 wrote to memory of 3560 2920 SPLOPE.exe 104 PID 4860 wrote to memory of 3668 4860 net.exe 105 PID 4860 wrote to memory of 3668 4860 net.exe 105 PID 4860 wrote to memory of 3668 4860 net.exe 105 PID 3560 wrote to memory of 3644 3560 SPLOPE.exe 106 PID 3560 wrote to memory of 3644 3560 SPLOPE.exe 106 PID 3560 wrote to memory of 3644 3560 SPLOPE.exe 106 PID 3560 wrote to memory of 1656 3560 SPLOPE.exe 172 PID 3560 wrote to memory of 1656 3560 SPLOPE.exe 172 PID 3560 wrote to memory of 1656 3560 SPLOPE.exe 172 PID 3644 wrote to memory of 4804 3644 net.exe 109 PID 3644 wrote to memory of 4804 3644 net.exe 109 PID 3644 wrote to memory of 4804 3644 net.exe 109 PID 1656 wrote to memory of 2792 1656 SPLOPE.exe 111 PID 1656 wrote to memory of 2792 1656 SPLOPE.exe 111 PID 1656 wrote to memory of 2792 1656 SPLOPE.exe 111 PID 1656 wrote to memory of 3092 1656 SPLOPE.exe 154 PID 1656 wrote to memory of 3092 1656 SPLOPE.exe 154 PID 1656 wrote to memory of 3092 1656 SPLOPE.exe 154 PID 2792 wrote to memory of 3620 2792 net.exe 114 PID 2792 wrote to memory of 3620 2792 net.exe 114 PID 2792 wrote to memory of 3620 2792 net.exe 114 PID 3092 wrote to memory of 4576 3092 SPLOPE.exe 115 PID 3092 wrote to memory of 4576 3092 SPLOPE.exe 115 PID 3092 wrote to memory of 4576 3092 SPLOPE.exe 115 PID 3092 wrote to memory of 2952 3092 SPLOPE.exe 211 PID 3092 wrote to memory of 2952 3092 SPLOPE.exe 211 PID 3092 wrote to memory of 2952 3092 SPLOPE.exe 211 PID 4576 wrote to memory of 400 4576 net.exe 250 PID 4576 wrote to memory of 400 4576 net.exe 250 PID 4576 wrote to memory of 400 4576 net.exe 250 PID 2952 wrote to memory of 1132 2952 SPLOPE.exe 305 PID 2952 wrote to memory of 1132 2952 SPLOPE.exe 305 PID 2952 wrote to memory of 1132 2952 SPLOPE.exe 305 PID 2952 wrote to memory of 2936 2952 SPLOPE.exe 225 PID 2952 wrote to memory of 2936 2952 SPLOPE.exe 225 PID 2952 wrote to memory of 2936 2952 SPLOPE.exe 225 PID 1132 wrote to memory of 2040 1132 net.exe 122 PID 1132 wrote to memory of 2040 1132 net.exe 122 PID 1132 wrote to memory of 2040 1132 net.exe 122 PID 2936 wrote to memory of 3164 2936 SPLOPE.exe 249 PID 2936 wrote to memory of 3164 2936 SPLOPE.exe 249 PID 2936 wrote to memory of 3164 2936 SPLOPE.exe 249 PID 2936 wrote to memory of 4924 2936 SPLOPE.exe 272 PID 2936 wrote to memory of 4924 2936 SPLOPE.exe 272 PID 2936 wrote to memory of 4924 2936 SPLOPE.exe 272 PID 3164 wrote to memory of 4528 3164 net.exe 177 PID 3164 wrote to memory of 4528 3164 net.exe 177 PID 3164 wrote to memory of 4528 3164 net.exe 177 PID 4924 wrote to memory of 4120 4924 SPLOPE.exe 417
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5ad35303d1ffad33cc1e0149b9944df.exe"C:\Users\Admin\AppData\Local\Temp\c5ad35303d1ffad33cc1e0149b9944df.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess3⤵PID:3628
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:3668
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess4⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess5⤵PID:4804
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess5⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess6⤵PID:3620
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess6⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess7⤵PID:400
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess7⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess8⤵PID:2040
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess8⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess9⤵PID:4528
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess9⤵PID:4120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess10⤵PID:4276
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2352 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess10⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess11⤵PID:2500
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3612 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess11⤵PID:4920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess12⤵PID:2880
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2336 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess12⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess13⤵PID:4364
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3356 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess13⤵PID:4368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess14⤵PID:916
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4964 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess14⤵PID:1288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess15⤵PID:4296
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1708 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess15⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess16⤵PID:3092
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4064 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess16⤵PID:1988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess17⤵PID:3760
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1920 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess17⤵PID:1712
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess18⤵PID:4600
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3988 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess18⤵PID:2016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess19⤵PID:4036
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4296 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess19⤵PID:3888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess20⤵PID:1548
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2008 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess20⤵PID:436
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵PID:1656
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess21⤵PID:1900
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:456 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess21⤵PID:1884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess22⤵PID:1928
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4528 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess22⤵PID:3412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess23⤵PID:2016
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:3556 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess23⤵PID:3560
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess24⤵PID:4676
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2368 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess24⤵PID:4964
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess25⤵PID:1988
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3604 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess25⤵PID:3176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess26⤵PID:1676
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:916 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess26⤵PID:3972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess27⤵PID:3412
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2016 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess27⤵PID:452
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess28⤵PID:3888
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:496 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess28⤵PID:4240
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess29⤵PID:2832
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2172 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess29⤵PID:2620
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess30⤵PID:2608
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:388 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess30⤵PID:2952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess31⤵PID:4368
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4920 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess31⤵PID:4340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess32⤵PID:4596
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1132 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess32⤵PID:2652
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess33⤵PID:2936
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2732 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess33⤵PID:1676
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess34⤵PID:5024
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4296 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess34⤵PID:3252
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess35⤵PID:3376
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4004 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess35⤵PID:3696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess36⤵PID:1072
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4544 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess36⤵PID:1568
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess37⤵PID:4368
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2620 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess37⤵PID:4804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess38⤵PID:1900
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1656 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess38⤵PID:3604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess39⤵PID:400
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3164 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess39⤵PID:4284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess40⤵PID:2652
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4992 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess40⤵PID:3752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess41⤵PID:1000
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2608 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess41⤵PID:4892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess42⤵PID:4080
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5036 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess42⤵PID:3672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess43⤵PID:4004
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3676 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess43⤵PID:2276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵PID:1568
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess44⤵PID:1000
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4264 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess44⤵PID:1884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵PID:4924
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess45⤵PID:1460
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:916 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess45⤵PID:3604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess46⤵PID:4252
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3080 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess46⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess47⤵PID:4036
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3752 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess47⤵PID:1920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess48⤵PID:3516
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4264 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess48⤵PID:4420
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:3604
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess49⤵PID:972
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:3588 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess49⤵PID:3092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess50⤵PID:808
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"49⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess50⤵PID:3308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess51⤵PID:1900
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"50⤵PID:4620
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess51⤵PID:3700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess52⤵PID:2952
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"51⤵PID:452
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess52⤵PID:4300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:1132
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess53⤵PID:4504
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"52⤵PID:5068
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess53⤵PID:2172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess54⤵PID:4320
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"53⤵PID:4180
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess54⤵PID:4664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess55⤵PID:5024
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"54⤵PID:3052
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess55⤵PID:1344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵PID:388
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess56⤵PID:2500
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"55⤵PID:3972
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess56⤵PID:4804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess57⤵PID:4368
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"56⤵PID:4284
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess57⤵PID:1924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess58⤵PID:4264
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"57⤵PID:2500
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess58⤵PID:2044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess59⤵PID:4804
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"58⤵PID:4112
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess59⤵PID:2172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess60⤵PID:3516
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"59⤵PID:2276
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess60⤵PID:4064
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess61⤵PID:2732
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"60⤵PID:5036
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess61⤵PID:3356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess62⤵PID:3516
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"61⤵PID:2500
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess62⤵PID:3628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess63⤵PID:3920
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"62⤵PID:1820
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess63⤵PID:4548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess64⤵PID:400
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"63⤵PID:1344
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess64⤵PID:1656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess65⤵PID:4368
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"64⤵PID:1248
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess65⤵PID:4992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess66⤵PID:2276
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"65⤵PID:4112
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess66⤵PID:972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess67⤵PID:2952
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"66⤵PID:4608
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess67⤵PID:4180
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess68⤵PID:4664
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"67⤵PID:3700
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess68⤵PID:4320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess69⤵PID:2164
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"68⤵PID:4504
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess69⤵PID:808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess70⤵PID:4892
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"69⤵PID:2936
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess70⤵PID:4284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess71⤵PID:3052
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"70⤵PID:4420
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess71⤵PID:2412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess72⤵PID:2644
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"71⤵PID:2620
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess72⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess73⤵PID:4684
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"72⤵PID:3308
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess73⤵PID:4068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess74⤵PID:4112
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"73⤵PID:2832
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess74⤵PID:972
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:1988
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess75⤵PID:2392
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"74⤵PID:2352
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess75⤵PID:2116
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess76⤵PID:2428
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"75⤵PID:5024
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess76⤵PID:4280
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess77⤵PID:1928
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"76⤵PID:452
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess77⤵PID:4596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess78⤵PID:4120
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"77⤵PID:4284
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess78⤵PID:3032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess79⤵PID:1856
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"78⤵PID:1860
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess79⤵PID:972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess80⤵PID:4120
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"79⤵PID:2288
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess80⤵PID:4012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess81⤵PID:4544
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"80⤵PID:436
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess81⤵PID:2392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess82⤵PID:3056
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"81⤵PID:4992
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess82⤵PID:2952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess83⤵PID:4804
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"82⤵PID:1212
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess83⤵PID:3752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess84⤵PID:1928
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"83⤵PID:4420
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess84⤵PID:3080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess85⤵PID:4320
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"84⤵PID:1484
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess85⤵PID:1856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess86⤵PID:4296
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"85⤵PID:1928
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess86⤵PID:3176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess87⤵PID:2652
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"86⤵PID:4112
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess87⤵PID:4596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess88⤵PID:4608
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"87⤵PID:456
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess88⤵PID:4252
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess89⤵PID:4284
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"88⤵PID:4684
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess89⤵PID:972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess90⤵PID:3052
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"89⤵PID:772
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess90⤵PID:4924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess91⤵PID:3356
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"90⤵PID:2644
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess91⤵PID:400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess92⤵PID:972
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"91⤵PID:3052
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess92⤵PID:3056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess93⤵PID:1844
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"92⤵PID:4420
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess93⤵PID:2172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess94⤵PID:4320
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"93⤵PID:1248
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess94⤵PID:916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess95⤵PID:3752
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"94⤵PID:4608
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess95⤵PID:1244
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV196⤵PID:3672
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess96⤵PID:3916
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"95⤵PID:232
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess96⤵PID:3308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess97⤵PID:4068
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"96⤵PID:3056
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess97⤵PID:2288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess98⤵PID:456
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"97⤵PID:2952
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess98⤵PID:1856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess99⤵PID:940
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"98⤵PID:1708
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess99⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess100⤵PID:4280
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"99⤵PID:1900
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess100⤵PID:400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess101⤵PID:1856
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"100⤵PID:940
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess101⤵PID:2008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess102⤵PID:1860
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"101⤵PID:4420
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess102⤵PID:4544
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess103⤵PID:400
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"102⤵PID:3612
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess103⤵PID:3752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess104⤵PID:2008
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"103⤵PID:4664
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess104⤵PID:3356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess105⤵PID:3916
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"104⤵PID:2276
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess105⤵PID:772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess106⤵PID:1844
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"105⤵PID:4320
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess106⤵PID:2392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess107⤵PID:4804
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"106⤵PID:4112
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess107⤵PID:2832
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess108⤵PID:1212
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"107⤵PID:3308
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess108⤵PID:4820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess109⤵PID:1856
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"108⤵PID:3612
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess109⤵PID:3536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess110⤵PID:2832
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"109⤵PID:772
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess110⤵PID:2288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess111⤵PID:4820
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"110⤵PID:1856
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess111⤵PID:748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess112⤵PID:3536
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"111⤵PID:4696
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess112⤵PID:2936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess113⤵PID:3612
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"112⤵PID:2288
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess113⤵PID:5024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess114⤵PID:4296
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"113⤵PID:4252
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess114⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess115⤵PID:2652
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"114⤵PID:3816
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess115⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess116⤵PID:5024
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"115⤵PID:232
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess116⤵PID:972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess117⤵PID:2728
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"116⤵PID:1928
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess117⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess118⤵PID:3516
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"117⤵PID:2884
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess118⤵PID:3676
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess119⤵PID:772
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"118⤵PID:1484
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess119⤵PID:3536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess120⤵PID:456
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"119⤵PID:4252
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess120⤵PID:1708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess121⤵PID:3920
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"120⤵PID:3700
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess121⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess122⤵PID:4604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-