d48fd97e81f9a59e85f04d92d680a5c16be3a31a4ec2e0e3c3cfcece07aab707

Analysis

max time kernel
9s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f378623cbc763412be864561511370ae_JaffaCakes118.exe
Size

1.3MB
MD5

f378623cbc763412be864561511370ae
SHA1

7b5cd8cbd4595da3d21f9b6e2e126dbefa6c6abd
SHA256

d48fd97e81f9a59e85f04d92d680a5c16be3a31a4ec2e0e3c3cfcece07aab707
SHA512

e9634008282c38a9b2980bd595143cafff85f0d636085040d3dd256e3f1aa7a917460827a7b5b93b6551274d514e7115607b4a58e608bf1cd10af7fbace321b3
SSDEEP

24576:8vgbyLg41N5L+s79FIY4ponf0e56xh3liEKKO7AynQedLSEgG:8vgb0gq9FOC0esxh1i/ldQ2GEx

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3660	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
3728	XP-FEBFA1C7.EXE
4784	XP-FEBFA1C7.EXE
4132	XP-FEBFA1C7.EXE
3332	XP-FEBFA1C7.EXE

Loads dropped DLL 64 IoCs

pid	Process
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE
3728	XP-FEBFA1C7.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	f378623cbc763412be864561511370ae_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE
File opened for modification	\??\PhysicalDrive0	XP-FEBFA1C7.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XP-FEBFA1C7.EXE	f378623cbc763412be864561511370ae_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\XP-FEBFA1C7.EXE	f378623cbc763412be864561511370ae_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 10 IoCs

pid	Process
3520	explorer.exe
1388	explorer.exe
3564	explorer.exe
772	explorer.exe
3224	explorer.exe
4992	explorer.exe
4360	explorer.exe
4816	explorer.exe
1124	explorer.exe
2948	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3520	explorer.exe
3520	explorer.exe
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
3660	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
2732	XP-FEBFA1C7.EXE
1388	explorer.exe
1388	explorer.exe
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
1556	XP-FEBFA1C7.EXE
3564	explorer.exe
3564	explorer.exe
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
3496	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
772	explorer.exe
772	explorer.exe
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
64	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
3224	explorer.exe
3224	explorer.exe
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1060	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
4992	explorer.exe
4992	explorer.exe
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
1748	XP-FEBFA1C7.EXE
4360	explorer.exe
4360	explorer.exe
4348	XP-FEBFA1C7.EXE
4348	XP-FEBFA1C7.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2524	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	86
PID 1868 wrote to memory of 2524	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	86
PID 1868 wrote to memory of 2524	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	86
PID 1868 wrote to memory of 3660	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	89
PID 1868 wrote to memory of 3660	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	89
PID 1868 wrote to memory of 3660	1868	f378623cbc763412be864561511370ae_JaffaCakes118.exe	89
PID 3660 wrote to memory of 5040	3660	XP-FEBFA1C7.EXE	90
PID 3660 wrote to memory of 5040	3660	XP-FEBFA1C7.EXE	90
PID 3660 wrote to memory of 5040	3660	XP-FEBFA1C7.EXE	90
PID 3660 wrote to memory of 2732	3660	XP-FEBFA1C7.EXE	91
PID 3660 wrote to memory of 2732	3660	XP-FEBFA1C7.EXE	91
PID 3660 wrote to memory of 2732	3660	XP-FEBFA1C7.EXE	91
PID 2732 wrote to memory of 548	2732	XP-FEBFA1C7.EXE	93
PID 2732 wrote to memory of 548	2732	XP-FEBFA1C7.EXE	93
PID 2732 wrote to memory of 548	2732	XP-FEBFA1C7.EXE	93
PID 2732 wrote to memory of 1556	2732	XP-FEBFA1C7.EXE	94
PID 2732 wrote to memory of 1556	2732	XP-FEBFA1C7.EXE	94
PID 2732 wrote to memory of 1556	2732	XP-FEBFA1C7.EXE	94
PID 1556 wrote to memory of 4636	1556	XP-FEBFA1C7.EXE	97
PID 1556 wrote to memory of 4636	1556	XP-FEBFA1C7.EXE	97
PID 1556 wrote to memory of 4636	1556	XP-FEBFA1C7.EXE	97
PID 1556 wrote to memory of 3496	1556	XP-FEBFA1C7.EXE	98
PID 1556 wrote to memory of 3496	1556	XP-FEBFA1C7.EXE	98
PID 1556 wrote to memory of 3496	1556	XP-FEBFA1C7.EXE	98
PID 3496 wrote to memory of 2068	3496	XP-FEBFA1C7.EXE	101
PID 3496 wrote to memory of 2068	3496	XP-FEBFA1C7.EXE	101
PID 3496 wrote to memory of 2068	3496	XP-FEBFA1C7.EXE	101
PID 3496 wrote to memory of 64	3496	XP-FEBFA1C7.EXE	102
PID 3496 wrote to memory of 64	3496	XP-FEBFA1C7.EXE	102
PID 3496 wrote to memory of 64	3496	XP-FEBFA1C7.EXE	102
PID 64 wrote to memory of 3364	64	XP-FEBFA1C7.EXE	104
PID 64 wrote to memory of 3364	64	XP-FEBFA1C7.EXE	104
PID 64 wrote to memory of 3364	64	XP-FEBFA1C7.EXE	104
PID 64 wrote to memory of 1060	64	XP-FEBFA1C7.EXE	181
PID 64 wrote to memory of 1060	64	XP-FEBFA1C7.EXE	181
PID 64 wrote to memory of 1060	64	XP-FEBFA1C7.EXE	181
PID 1060 wrote to memory of 2576	1060	XP-FEBFA1C7.EXE	107
PID 1060 wrote to memory of 2576	1060	XP-FEBFA1C7.EXE	107
PID 1060 wrote to memory of 2576	1060	XP-FEBFA1C7.EXE	107
PID 1060 wrote to memory of 1748	1060	XP-FEBFA1C7.EXE	108
PID 1060 wrote to memory of 1748	1060	XP-FEBFA1C7.EXE	108
PID 1060 wrote to memory of 1748	1060	XP-FEBFA1C7.EXE	108
PID 1748 wrote to memory of 692	1748	XP-FEBFA1C7.EXE	110
PID 1748 wrote to memory of 692	1748	XP-FEBFA1C7.EXE	110
PID 1748 wrote to memory of 692	1748	XP-FEBFA1C7.EXE	110
PID 1748 wrote to memory of 4348	1748	XP-FEBFA1C7.EXE	111
PID 1748 wrote to memory of 4348	1748	XP-FEBFA1C7.EXE	111
PID 1748 wrote to memory of 4348	1748	XP-FEBFA1C7.EXE	111
PID 4348 wrote to memory of 4680	4348	XP-FEBFA1C7.EXE	113
PID 4348 wrote to memory of 4680	4348	XP-FEBFA1C7.EXE	113
PID 4348 wrote to memory of 4680	4348	XP-FEBFA1C7.EXE	113
PID 4348 wrote to memory of 3728	4348	XP-FEBFA1C7.EXE	114
PID 4348 wrote to memory of 3728	4348	XP-FEBFA1C7.EXE	114
PID 4348 wrote to memory of 3728	4348	XP-FEBFA1C7.EXE	114
PID 3728 wrote to memory of 4884	3728	XP-FEBFA1C7.EXE	130
PID 3728 wrote to memory of 4884	3728	XP-FEBFA1C7.EXE	130
PID 3728 wrote to memory of 4884	3728	XP-FEBFA1C7.EXE	130
PID 3728 wrote to memory of 4784	3728	XP-FEBFA1C7.EXE	117
PID 3728 wrote to memory of 4784	3728	XP-FEBFA1C7.EXE	117
PID 3728 wrote to memory of 4784	3728	XP-FEBFA1C7.EXE	117
PID 4784 wrote to memory of 3344	4784	XP-FEBFA1C7.EXE	119
PID 4784 wrote to memory of 3344	4784	XP-FEBFA1C7.EXE	119
PID 4784 wrote to memory of 3344	4784	XP-FEBFA1C7.EXE	119
PID 4784 wrote to memory of 4132	4784	XP-FEBFA1C7.EXE	120

C:\Users\Admin\AppData\Local\Temp\f378623cbc763412be864561511370ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f378623cbc763412be864561511370ae_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\f378623cbc763412be864561511370ae_JaffaCakes118
  2⤵
  PID:2524
- C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
  C:\Windows\system32\XP-FEBFA1C7.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Windows\SysWOW64\XP-FEBFA1C7
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
    C:\Windows\system32\XP-FEBFA1C7.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Windows\SysWOW64\XP-FEBFA1C7
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
      C:\Windows\system32\XP-FEBFA1C7.EXE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        5⤵
        
        PID:4636
    - - C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3496
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        6⤵
        
        PID:2068
      - C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        7⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        8⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        9⤵
        
        PID:692
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        10⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        11⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        11⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        12⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        12⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        
        PID:4132
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        13⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        13⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        14⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        14⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        15⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        15⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        16⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        16⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        17⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        17⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        18⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        18⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        19⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        19⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        20⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        20⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        21⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        21⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        22⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        22⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        23⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        23⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        24⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        24⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        25⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        25⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        26⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        26⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        27⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        27⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        28⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        28⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        29⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        29⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        30⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        30⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        31⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        31⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        32⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        32⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        33⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        33⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        34⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        34⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        35⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        35⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        36⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        36⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        37⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        37⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        38⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        38⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        39⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        39⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        40⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        40⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        41⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        41⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        42⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        42⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        43⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        43⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        44⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        44⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        45⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        45⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        46⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        46⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        47⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        47⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        48⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        48⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        49⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        49⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        50⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        50⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        51⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        51⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        52⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        52⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        53⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        53⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        54⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        54⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        55⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        55⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        56⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        56⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        57⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        57⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        58⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        58⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        59⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        59⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        60⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        60⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        61⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        61⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        62⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        62⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        63⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        63⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        64⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        64⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        65⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        65⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        66⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        66⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        67⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        67⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        68⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        68⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        69⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        69⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        70⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        70⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        71⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        71⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        72⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        72⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        73⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        73⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        74⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        74⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        75⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        75⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        76⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        76⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        77⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        77⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        78⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        78⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        79⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        79⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        80⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        80⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        81⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        81⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        82⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        82⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        83⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        83⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        84⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        84⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        85⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        85⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        86⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        86⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        87⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        87⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        88⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        88⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        89⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        89⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        90⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        90⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        91⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        91⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        92⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        92⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        93⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        93⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        94⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        94⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        95⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        95⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        96⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        96⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        97⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        97⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        98⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        98⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        99⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        99⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        100⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        100⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        101⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        101⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        102⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        102⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        103⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        103⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        104⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        104⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        105⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        105⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        106⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        106⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        107⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        107⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        108⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        108⤵
        
        PID:748
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        109⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        109⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        110⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        110⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        111⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        111⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        112⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        112⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        113⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        113⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        114⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        114⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        115⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        115⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        116⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        116⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        117⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        117⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        118⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        118⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        119⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        119⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        120⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        120⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        121⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        121⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        122⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        122⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        123⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        123⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        124⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        124⤵
        
        PID:232
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        125⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        125⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        126⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        126⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        127⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        127⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        128⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        128⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        129⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        129⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        130⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        130⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        131⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        131⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        132⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        132⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        133⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        133⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        134⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        134⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        135⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        135⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        136⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        136⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        137⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        137⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        138⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        138⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        139⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        139⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        140⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        140⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        141⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        141⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        142⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        142⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        143⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        143⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        144⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        144⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        145⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        145⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        146⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        146⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        147⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        147⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        148⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        148⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        149⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        149⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        150⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\XP-FEBFA1C7.EXE
        
        C:\Windows\system32\XP-FEBFA1C7.EXE
        150⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\XP-FEBFA1C7
        151⤵
        
        PID:11680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:4816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:2948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1980

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5652

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8036

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8396

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10284

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4304

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fnr

Filesize
212KB

MD5
a67daddcb30335163cf7d99f282f5ae0

SHA1
c033169006bef68bebfa77405c4a35688ab41a99

SHA256
8027e7512cf17388b14c3e2bbf9c3700f875c26d942a4dd27d1dcf8203a192f8

SHA512
16cb5cffdf935d10bb06b86b874a63e9594e4854359885890fe4641f0e4329fd047daa5f0ddd5a02d241974834b67666b2ad65ef791e110d29637434057808c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\com.run

Filesize
260KB

MD5
ce2f773275d3fe8b78f4cf067d5e6a0f

SHA1
b7135e34d46eb4303147492d5cee5e1ef7b392ab

SHA256
eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d

SHA512
d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

Filesize
112KB

MD5
6d4b2e73f6f8ecff02f19f7e8ef9a8c7

SHA1
09c32ca167136a17fd69df8c525ea5ffeca6c534

SHA256
fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

SHA512
2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

Filesize
316KB

MD5
25b794b18bd8d03dc9530111cbce4173

SHA1
a6774d62bd1e9497fdfe6c61c495011fc6c274c6

SHA256
81757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4

SHA512
5892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

Filesize
180KB

MD5
56e9e121d68b5631a360d56b2ef4777f

SHA1
e9d11a2baf46769c90ee1671cd17072efd8cfb52

SHA256
c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f

SHA512
1ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

Filesize
1.0MB

MD5
1081d7eb7a17faedfa588b93fc85365e

SHA1
884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f

SHA256
0351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0

SHA512
1ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\shell.fne

Filesize
40KB

MD5
d54753e7fc3ea03aec0181447969c0e8

SHA1
824e7007b6569ae36f174c146ae1b7242f98f734

SHA256
192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9

SHA512
c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

Filesize
68KB

MD5
1518651c682109e9b9c304c9c109d777

SHA1
6c440810bf11907fc16dbca17a9494377c0bdcf1

SHA256
0496ea1f78bf11204491388bc9c1dfbb49bebdaeffe32717bffdf688b148bfaa

SHA512
e6e03475b37f8463ac47dd559b31b81e254b07280e083200e21cc66f022c8730d45924776684d96e6bc1ce2d5cf9350a13ca37cda966de1c430eeec602e00535

Download Submit
C:\Windows\SysWOW64\XP-FEBFA1C7.EXE

Filesize
1.3MB

MD5
f378623cbc763412be864561511370ae

SHA1
7b5cd8cbd4595da3d21f9b6e2e126dbefa6c6abd

SHA256
d48fd97e81f9a59e85f04d92d680a5c16be3a31a4ec2e0e3c3cfcece07aab707

SHA512
e9634008282c38a9b2980bd595143cafff85f0d636085040d3dd256e3f1aa7a917460827a7b5b93b6551274d514e7115607b4a58e608bf1cd10af7fbace321b3

Download Submit
memory/64-132-0x0000000002190000-0x00000000021DA000-memory.dmp

Filesize
296KB

Download
memory/64-124-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/64-135-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download
memory/64-164-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1060-144-0x00000000026F0000-0x000000000270E000-memory.dmp

Filesize
120KB

Download
memory/1060-141-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1060-417-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1060-142-0x0000000002390000-0x00000000023DA000-memory.dmp

Filesize
296KB

Download
memory/1060-174-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1060-385-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1060-145-0x0000000002710000-0x0000000002721000-memory.dmp

Filesize
68KB

Download
memory/1064-211-0x0000000002400000-0x000000000241E000-memory.dmp

Filesize
120KB

Download
memory/1064-243-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1064-209-0x0000000002310000-0x000000000235A000-memory.dmp

Filesize
296KB

Download
memory/1064-204-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-80-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-97-0x0000000002390000-0x00000000023AE000-memory.dmp

Filesize
120KB

Download
memory/1556-100-0x00000000023B0000-0x00000000023C1000-memory.dmp

Filesize
68KB

Download
memory/1556-92-0x00000000020C0000-0x000000000210A000-memory.dmp

Filesize
296KB

Download
memory/1556-136-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-190-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-146-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-151-0x0000000002420000-0x000000000246A000-memory.dmp

Filesize
296KB

Download
memory/1748-153-0x0000000002840000-0x000000000285E000-memory.dmp

Filesize
120KB

Download
memory/1748-155-0x0000000002870000-0x0000000002881000-memory.dmp

Filesize
68KB

Download
memory/1868-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1868-94-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1868-28-0x0000000002570000-0x0000000002581000-memory.dmp

Filesize
68KB

Download
memory/1868-22-0x00000000024C0000-0x00000000024DE000-memory.dmp

Filesize
120KB

Download
memory/1868-15-0x0000000002430000-0x000000000247A000-memory.dmp

Filesize
296KB

Download
memory/2272-293-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2272-254-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2732-75-0x0000000002F50000-0x0000000002F6E000-memory.dmp

Filesize
120KB

Download
memory/2732-123-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2732-71-0x00000000022B0000-0x00000000022FA000-memory.dmp

Filesize
296KB

Download
memory/2732-78-0x0000000003070000-0x0000000003081000-memory.dmp

Filesize
68KB

Download
memory/2772-437-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2812-273-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2812-234-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3332-199-0x0000000002280000-0x00000000022CA000-memory.dmp

Filesize
296KB

Download
memory/3332-233-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3496-154-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3496-118-0x0000000002410000-0x000000000242E000-memory.dmp

Filesize
120KB

Download
memory/3496-121-0x0000000002F80000-0x0000000002F91000-memory.dmp

Filesize
68KB

Download
memory/3496-113-0x00000000022E0000-0x000000000232A000-memory.dmp

Filesize
296KB

Download
memory/3660-323-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3660-115-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3660-361-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3660-58-0x00000000026C0000-0x00000000026D1000-memory.dmp

Filesize
68KB

Download
memory/3660-54-0x0000000002490000-0x00000000024AE000-memory.dmp

Filesize
120KB

Download
memory/3660-49-0x0000000002260000-0x00000000022AA000-memory.dmp

Filesize
296KB

Download
memory/3728-173-0x0000000002730000-0x0000000002741000-memory.dmp

Filesize
68KB

Download
memory/3728-172-0x0000000002460000-0x000000000247E000-memory.dmp

Filesize
120KB

Download
memory/3728-170-0x0000000002140000-0x000000000218A000-memory.dmp

Filesize
296KB

Download
memory/3728-165-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3728-203-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4132-193-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download
memory/4132-223-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4132-189-0x0000000002120000-0x000000000216A000-memory.dmp

Filesize
296KB

Download
memory/4132-192-0x0000000002510000-0x000000000252E000-memory.dmp

Filesize
120KB

Download
memory/4132-188-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4348-160-0x00000000023A0000-0x00000000023EA000-memory.dmp

Filesize
296KB

Download
memory/4348-163-0x0000000002810000-0x0000000002821000-memory.dmp

Filesize
68KB

Download
memory/4348-162-0x00000000027D0000-0x00000000027EE000-memory.dmp

Filesize
120KB

Download
memory/4348-198-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4468-290-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4468-248-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4672-214-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4672-222-0x00000000026F0000-0x0000000002701000-memory.dmp

Filesize
68KB

Download
memory/4672-221-0x00000000026B0000-0x00000000026CE000-memory.dmp

Filesize
120KB

Download
memory/4672-253-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4672-219-0x0000000002160000-0x00000000021AA000-memory.dmp

Filesize
296KB

Download
memory/4784-183-0x0000000002440000-0x0000000002451000-memory.dmp

Filesize
68KB

Download
memory/4784-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4784-179-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4784-180-0x0000000002130000-0x000000000217A000-memory.dmp

Filesize
296KB

Download
memory/4792-263-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4792-232-0x0000000002F70000-0x0000000002F81000-memory.dmp

Filesize
68KB

Download
memory/4792-231-0x00000000026C0000-0x00000000026DE000-memory.dmp

Filesize
120KB

Download
memory/4792-229-0x0000000002220000-0x000000000226A000-memory.dmp

Filesize
296KB

Download
memory/4792-228-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5080-264-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5080-302-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5268-274-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5268-312-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5304-371-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5424-287-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5424-322-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5544-366-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5544-400-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5600-332-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5652-342-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5652-380-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5800-307-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5800-341-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5856-356-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5856-390-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5896-408-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5900-391-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5900-427-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5960-317-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5960-351-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6192-414-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6192-447-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6376-424-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6580-434-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6768-445-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads