Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
c20ba488f338182af6591ae4b92280b6
-
SHA1
6389d14ddc02284bd1eb128cce788b72060f2f91
-
SHA256
a6acda54c2268a3fda4d7afafab5a7e600846f856b582ed224230f983d266eea
-
SHA512
c8b817936055ec8128f2f4567220d8dd1af9790a49ebbb518e57328b7325433cb21b04c8206698ea2dd0ab890b2fe4dc6840c8acae680df23bb3874a625b9869
-
SSDEEP
24576:t8UpE7WjSq7WjS70bISMFSRx+SILin5QxhNQ7lck+MHPY9LXfmsXpV2jr1VT7g+l:tH+WjS6WjS7KdvIW5Qxk+xJXxWjr1xnl
Malware Config
Signatures
-
Executes dropped EXE 17 IoCs
pid Process 4700 DECB07.EXE 4864 DECB07.EXE 5068 DECB07.EXE 4456 DECB07.EXE 3984 DECB07.EXE 2480 DECB07.EXE 1564 DECB07.EXE 4820 DECB07.EXE 4540 DECB07.EXE 4060 DECB07.EXE 3972 DECB07.EXE 3020 DECB07.EXE 8 DECB07.EXE 5100 DECB07.EXE 3672 DECB07.EXE 1072 DECB07.EXE 3368 DECB07.EXE -
Loads dropped DLL 64 IoCs
pid Process 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4540 DECB07.EXE -
Writes to the Master Boot Record (MBR) 1 TTPs 17 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE File opened for modification \??\PhysicalDrive0 DECB07.EXE -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\06794E\ c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE File created C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\04764D\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\B526A5\DECB07.EXE DECB07.EXE File opened for modification C:\Windows\SysWOW64\06794E\ DECB07.EXE File opened for modification C:\Windows\SysWOW64\02A732\ DECB07.EXE -
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB07.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe -
Suspicious behavior: AddClipboardFormatListener 10 IoCs
pid Process 3312 explorer.exe 2720 explorer.exe 1560 explorer.exe 4148 explorer.exe 1112 explorer.exe 2348 explorer.exe 4288 explorer.exe 4312 explorer.exe 1340 explorer.exe 2900 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4700 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 4864 DECB07.EXE 3312 explorer.exe 3312 explorer.exe 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 5068 DECB07.EXE 2720 explorer.exe 2720 explorer.exe 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 4456 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 3984 DECB07.EXE 1560 explorer.exe 1560 explorer.exe 4148 explorer.exe 4148 explorer.exe 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 2480 DECB07.EXE 1112 explorer.exe 1112 explorer.exe 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 1564 DECB07.EXE 2348 explorer.exe 2348 explorer.exe 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE 4820 DECB07.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3288 wrote to memory of 3352 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 84 PID 3288 wrote to memory of 3352 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 84 PID 3288 wrote to memory of 3352 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 84 PID 3288 wrote to memory of 4700 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 86 PID 3288 wrote to memory of 4700 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 86 PID 3288 wrote to memory of 4700 3288 c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe 86 PID 4700 wrote to memory of 3092 4700 DECB07.EXE 87 PID 4700 wrote to memory of 3092 4700 DECB07.EXE 87 PID 4700 wrote to memory of 3092 4700 DECB07.EXE 87 PID 4700 wrote to memory of 4864 4700 DECB07.EXE 88 PID 4700 wrote to memory of 4864 4700 DECB07.EXE 88 PID 4700 wrote to memory of 4864 4700 DECB07.EXE 88 PID 4864 wrote to memory of 3844 4864 DECB07.EXE 90 PID 4864 wrote to memory of 3844 4864 DECB07.EXE 90 PID 4864 wrote to memory of 3844 4864 DECB07.EXE 90 PID 4864 wrote to memory of 5068 4864 DECB07.EXE 124 PID 4864 wrote to memory of 5068 4864 DECB07.EXE 124 PID 4864 wrote to memory of 5068 4864 DECB07.EXE 124 PID 5068 wrote to memory of 4184 5068 DECB07.EXE 288 PID 5068 wrote to memory of 4184 5068 DECB07.EXE 288 PID 5068 wrote to memory of 4184 5068 DECB07.EXE 288 PID 5068 wrote to memory of 4456 5068 DECB07.EXE 125 PID 5068 wrote to memory of 4456 5068 DECB07.EXE 125 PID 5068 wrote to memory of 4456 5068 DECB07.EXE 125 PID 4456 wrote to memory of 3152 4456 DECB07.EXE 97 PID 4456 wrote to memory of 3152 4456 DECB07.EXE 97 PID 4456 wrote to memory of 3152 4456 DECB07.EXE 97 PID 4456 wrote to memory of 3984 4456 DECB07.EXE 98 PID 4456 wrote to memory of 3984 4456 DECB07.EXE 98 PID 4456 wrote to memory of 3984 4456 DECB07.EXE 98 PID 3984 wrote to memory of 4020 3984 DECB07.EXE 100 PID 3984 wrote to memory of 4020 3984 DECB07.EXE 100 PID 3984 wrote to memory of 4020 3984 DECB07.EXE 100 PID 3984 wrote to memory of 2480 3984 DECB07.EXE 101 PID 3984 wrote to memory of 2480 3984 DECB07.EXE 101 PID 3984 wrote to memory of 2480 3984 DECB07.EXE 101 PID 2480 wrote to memory of 5100 2480 DECB07.EXE 126 PID 2480 wrote to memory of 5100 2480 DECB07.EXE 126 PID 2480 wrote to memory of 5100 2480 DECB07.EXE 126 PID 2480 wrote to memory of 1564 2480 DECB07.EXE 104 PID 2480 wrote to memory of 1564 2480 DECB07.EXE 104 PID 2480 wrote to memory of 1564 2480 DECB07.EXE 104 PID 1564 wrote to memory of 4520 1564 DECB07.EXE 106 PID 1564 wrote to memory of 4520 1564 DECB07.EXE 106 PID 1564 wrote to memory of 4520 1564 DECB07.EXE 106 PID 1564 wrote to memory of 4820 1564 DECB07.EXE 147 PID 1564 wrote to memory of 4820 1564 DECB07.EXE 147 PID 1564 wrote to memory of 4820 1564 DECB07.EXE 147 PID 4820 wrote to memory of 5024 4820 DECB07.EXE 110 PID 4820 wrote to memory of 5024 4820 DECB07.EXE 110 PID 4820 wrote to memory of 5024 4820 DECB07.EXE 110 PID 4820 wrote to memory of 4540 4820 DECB07.EXE 111 PID 4820 wrote to memory of 4540 4820 DECB07.EXE 111 PID 4820 wrote to memory of 4540 4820 DECB07.EXE 111 PID 4540 wrote to memory of 1368 4540 DECB07.EXE 113 PID 4540 wrote to memory of 1368 4540 DECB07.EXE 113 PID 4540 wrote to memory of 1368 4540 DECB07.EXE 113 PID 4540 wrote to memory of 4060 4540 DECB07.EXE 114 PID 4540 wrote to memory of 4060 4540 DECB07.EXE 114 PID 4540 wrote to memory of 4060 4540 DECB07.EXE 114 PID 4060 wrote to memory of 2464 4060 DECB07.EXE 116 PID 4060 wrote to memory of 2464 4060 DECB07.EXE 116 PID 4060 wrote to memory of 2464 4060 DECB07.EXE 116 PID 4060 wrote to memory of 3972 4060 DECB07.EXE 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c20ba488f338182af6591ae4b92280b6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\c20ba488f338182af6591ae4b92280b6_JaffaCakes1182⤵
- System Location Discovery: System Language Discovery
PID:3352
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB073⤵
- System Location Discovery: System Language Discovery
PID:3092
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB074⤵
- System Location Discovery: System Language Discovery
PID:3844
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB075⤵
- System Location Discovery: System Language Discovery
PID:4184
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB076⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB077⤵
- System Location Discovery: System Language Discovery
PID:4020
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB078⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB079⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0710⤵
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0711⤵
- System Location Discovery: System Language Discovery
PID:1368
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE11⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0712⤵
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE12⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0713⤵
- System Location Discovery: System Language Discovery
PID:4388
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE13⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0714⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE14⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:8 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0715⤵
- System Location Discovery: System Language Discovery
PID:4456
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0716⤵
- System Location Discovery: System Language Discovery
PID:3132
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE16⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0717⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE17⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0718⤵
- System Location Discovery: System Language Discovery
PID:552
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0719⤵PID:1088
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE19⤵PID:3464
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0720⤵PID:2372
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE20⤵PID:1028
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0721⤵PID:4256
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE21⤵PID:836
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0722⤵PID:744
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE22⤵PID:1456
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0723⤵PID:4500
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE23⤵PID:4864
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0724⤵PID:5036
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE24⤵PID:5188
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0725⤵PID:5304
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE25⤵PID:5376
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0726⤵PID:5484
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE26⤵PID:5576
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0727⤵PID:5724
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE27⤵PID:5788
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0728⤵PID:5912
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE28⤵PID:5996
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0729⤵PID:6132
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE29⤵PID:5224
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0730⤵PID:5152
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE30⤵PID:5552
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0731⤵PID:5836
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE31⤵PID:5192
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0732⤵PID:1072
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE32⤵PID:5696
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0733⤵PID:5628
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE33⤵PID:5492
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0734⤵PID:5496
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE34⤵PID:5136
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0735⤵PID:5764
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE35⤵PID:5784
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0736⤵PID:6208
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE36⤵PID:6260
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0737⤵PID:6372
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE37⤵PID:6432
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0738⤵PID:6576
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE38⤵PID:6648
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0739⤵PID:6748
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE39⤵PID:6836
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0740⤵PID:7016
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE40⤵PID:7116
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0741⤵PID:1516
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE41⤵PID:6292
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0742⤵PID:6516
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE42⤵PID:6180
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0743⤵PID:6768
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE43⤵PID:6872
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0744⤵PID:6764
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE44⤵PID:6544
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0745⤵PID:7016
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE45⤵PID:6284
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0746⤵PID:6556
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE46⤵PID:6776
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0747⤵PID:6764
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE47⤵PID:6768
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0748⤵PID:5196
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE48⤵PID:6620
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0749⤵PID:7092
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE49⤵PID:7180
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0750⤵PID:7300
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE50⤵PID:7344
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0751⤵PID:7480
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE51⤵PID:7544
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0752⤵PID:7652
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE52⤵PID:7688
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0753⤵PID:7788
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE53⤵PID:7840
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0754⤵PID:7964
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE54⤵PID:8016
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0755⤵PID:8128
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE55⤵PID:8160
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0756⤵PID:7388
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE56⤵PID:6244
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0757⤵PID:7608
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE57⤵PID:7520
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0758⤵PID:7684
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE58⤵PID:7916
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0759⤵PID:1480
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE59⤵PID:8012
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0760⤵PID:8148
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE60⤵PID:7716
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0761⤵PID:7104
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE61⤵PID:7376
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0762⤵PID:7964
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE62⤵PID:7656
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0763⤵PID:8068
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE63⤵PID:4376
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0764⤵PID:7436
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE64⤵PID:8140
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0765⤵PID:7728
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE65⤵PID:8020
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0766⤵PID:1260
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE66⤵PID:4184
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0767⤵PID:3324
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE67⤵PID:8232
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0768⤵PID:8324
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE68⤵PID:8388
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0769⤵PID:8520
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE69⤵PID:8588
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0770⤵PID:8668
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE70⤵PID:8704
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0771⤵PID:8828
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE71⤵PID:8896
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0772⤵PID:9008
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE72⤵PID:9044
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0773⤵PID:9156
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE73⤵PID:9196
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0774⤵PID:8224
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE74⤵PID:5172
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0775⤵PID:8164
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE75⤵PID:6016
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0776⤵PID:8520
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE76⤵PID:5468
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0777⤵PID:8936
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE77⤵PID:8608
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0778⤵PID:8704
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE78⤵PID:8436
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0779⤵PID:5508
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE79⤵PID:5224
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0780⤵PID:9196
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE80⤵PID:5124
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0781⤵PID:8636
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE81⤵PID:5420
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0782⤵PID:6600
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE82⤵PID:5672
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0783⤵PID:8212
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE83⤵PID:9016
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0784⤵PID:5172
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE84⤵PID:8296
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0785⤵PID:8540
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE85⤵PID:5616
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0786⤵PID:9324
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE86⤵PID:9364
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0787⤵PID:9472
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE87⤵PID:9516
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0788⤵PID:9640
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE88⤵PID:9696
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0789⤵PID:9804
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE89⤵PID:9876
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0790⤵PID:9992
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE90⤵PID:10032
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0791⤵PID:10140
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE91⤵PID:10208
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0792⤵PID:3740
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE92⤵PID:6276
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0793⤵PID:9580
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE93⤵PID:4200
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0794⤵PID:5616
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE94⤵PID:9736
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0795⤵PID:9440
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE95⤵PID:9884
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0796⤵PID:9856
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE96⤵PID:10012
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0797⤵PID:10196
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE97⤵PID:10140
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0798⤵PID:10132
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE98⤵PID:10212
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB0799⤵PID:2844
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE99⤵PID:8648
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07100⤵PID:9620
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE100⤵PID:9880
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07101⤵PID:9408
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE101⤵PID:9692
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07102⤵PID:3308
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE102⤵PID:9892
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07103⤵PID:9304
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE103⤵PID:10196
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07104⤵PID:7032
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE104⤵PID:7808
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07105⤵PID:10340
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE105⤵PID:10584
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07106⤵PID:10720
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE106⤵PID:10756
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07107⤵PID:10880
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE107⤵PID:10928
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07108⤵PID:11040
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE108⤵PID:11112
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07109⤵PID:6648
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE109⤵PID:8364
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07110⤵PID:8836
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE110⤵PID:2280
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07111⤵PID:8844
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE111⤵PID:10720
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07112⤵PID:10704
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE112⤵PID:11044
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07113⤵PID:6024
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE113⤵PID:8492
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07114⤵PID:10676
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE114⤵PID:8396
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07115⤵PID:6832
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE115⤵PID:11152
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07116⤵PID:2280
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE116⤵PID:10608
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07117⤵PID:10756
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE117⤵PID:6992
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07118⤵PID:7032
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE118⤵PID:10920
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07119⤵PID:10756
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE119⤵PID:11300
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07120⤵PID:11420
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE120⤵PID:11448
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07121⤵PID:11584
-
-
C:\Windows\SysWOW64\B526A5\DECB07.EXEC:\Windows\system32\B526A5\DECB07.EXE121⤵PID:11640
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\B526A5\DECB07122⤵PID:11760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-