Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
2530def488a99d27c611bc134e1e3934
-
SHA1
edd162e96a572b46fbcf8ba22ee21fefcf5bbc13
-
SHA256
01a96940c20878157aa85abb198f7aa2c211d828bc15e32d5257298bb0635b4b
-
SHA512
75e67dfdc12e0019b684051ebfa9525135ca6fa9bce8d487ee62dcadb77d073b1da44e09dae301b40a1f839955b75f0ceb016d9e3f8629bb62e91e868c18d0cf
-
SSDEEP
24576:nhTjcRKZWKxN31yueVCfDdij38ZW2bE95hR4KHGe7cFnohytzMkJcD+PDe:nBcRMvFaPsZW+E9PHH7kohyzJtre
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
pid Process 872 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 1180 XP-0EE37CC5.EXE 4548 XP-0EE37CC5.EXE 4972 XP-0EE37CC5.EXE -
Loads dropped DLL 64 IoCs
pid Process 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 1180 XP-0EE37CC5.EXE -
Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE File opened for modification \??\PhysicalDrive0 XP-0EE37CC5.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\XP-0EE37CC5.EXE 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\XP-0EE37CC5.EXE 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XP-0EE37CC5.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 explorer.exe -
Suspicious behavior: AddClipboardFormatListener 7 IoCs
pid Process 1884 explorer.exe 4252 explorer.exe 4036 explorer.exe 400 explorer.exe 4568 explorer.exe 2624 explorer.exe 2960 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 872 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 424 XP-0EE37CC5.EXE 4252 explorer.exe 4252 explorer.exe 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 2792 XP-0EE37CC5.EXE 1884 explorer.exe 1884 explorer.exe 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 2360 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4912 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 400 explorer.exe 400 explorer.exe 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4888 XP-0EE37CC5.EXE 4036 explorer.exe 4036 explorer.exe 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 3776 XP-0EE37CC5.EXE 4568 explorer.exe 4568 explorer.exe 3776 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE 3356 XP-0EE37CC5.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 216 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 86 PID 116 wrote to memory of 216 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 86 PID 116 wrote to memory of 216 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 86 PID 116 wrote to memory of 872 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 88 PID 116 wrote to memory of 872 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 88 PID 116 wrote to memory of 872 116 2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe 88 PID 872 wrote to memory of 3424 872 XP-0EE37CC5.EXE 89 PID 872 wrote to memory of 3424 872 XP-0EE37CC5.EXE 89 PID 872 wrote to memory of 3424 872 XP-0EE37CC5.EXE 89 PID 872 wrote to memory of 424 872 XP-0EE37CC5.EXE 90 PID 872 wrote to memory of 424 872 XP-0EE37CC5.EXE 90 PID 872 wrote to memory of 424 872 XP-0EE37CC5.EXE 90 PID 424 wrote to memory of 4936 424 XP-0EE37CC5.EXE 92 PID 424 wrote to memory of 4936 424 XP-0EE37CC5.EXE 92 PID 424 wrote to memory of 4936 424 XP-0EE37CC5.EXE 92 PID 424 wrote to memory of 2792 424 XP-0EE37CC5.EXE 204 PID 424 wrote to memory of 2792 424 XP-0EE37CC5.EXE 204 PID 424 wrote to memory of 2792 424 XP-0EE37CC5.EXE 204 PID 2792 wrote to memory of 4308 2792 XP-0EE37CC5.EXE 95 PID 2792 wrote to memory of 4308 2792 XP-0EE37CC5.EXE 95 PID 2792 wrote to memory of 4308 2792 XP-0EE37CC5.EXE 95 PID 2792 wrote to memory of 2360 2792 XP-0EE37CC5.EXE 130 PID 2792 wrote to memory of 2360 2792 XP-0EE37CC5.EXE 130 PID 2792 wrote to memory of 2360 2792 XP-0EE37CC5.EXE 130 PID 2360 wrote to memory of 4004 2360 XP-0EE37CC5.EXE 98 PID 2360 wrote to memory of 4004 2360 XP-0EE37CC5.EXE 98 PID 2360 wrote to memory of 4004 2360 XP-0EE37CC5.EXE 98 PID 2360 wrote to memory of 4912 2360 XP-0EE37CC5.EXE 100 PID 2360 wrote to memory of 4912 2360 XP-0EE37CC5.EXE 100 PID 2360 wrote to memory of 4912 2360 XP-0EE37CC5.EXE 100 PID 4912 wrote to memory of 1240 4912 XP-0EE37CC5.EXE 101 PID 4912 wrote to memory of 1240 4912 XP-0EE37CC5.EXE 101 PID 4912 wrote to memory of 1240 4912 XP-0EE37CC5.EXE 101 PID 4912 wrote to memory of 4888 4912 XP-0EE37CC5.EXE 133 PID 4912 wrote to memory of 4888 4912 XP-0EE37CC5.EXE 133 PID 4912 wrote to memory of 4888 4912 XP-0EE37CC5.EXE 133 PID 4888 wrote to memory of 4844 4888 XP-0EE37CC5.EXE 104 PID 4888 wrote to memory of 4844 4888 XP-0EE37CC5.EXE 104 PID 4888 wrote to memory of 4844 4888 XP-0EE37CC5.EXE 104 PID 4888 wrote to memory of 3776 4888 XP-0EE37CC5.EXE 105 PID 4888 wrote to memory of 3776 4888 XP-0EE37CC5.EXE 105 PID 4888 wrote to memory of 3776 4888 XP-0EE37CC5.EXE 105 PID 3776 wrote to memory of 4344 3776 XP-0EE37CC5.EXE 148 PID 3776 wrote to memory of 4344 3776 XP-0EE37CC5.EXE 148 PID 3776 wrote to memory of 4344 3776 XP-0EE37CC5.EXE 148 PID 3776 wrote to memory of 3356 3776 XP-0EE37CC5.EXE 419 PID 3776 wrote to memory of 3356 3776 XP-0EE37CC5.EXE 419 PID 3776 wrote to memory of 3356 3776 XP-0EE37CC5.EXE 419 PID 3356 wrote to memory of 4388 3356 XP-0EE37CC5.EXE 110 PID 3356 wrote to memory of 4388 3356 XP-0EE37CC5.EXE 110 PID 3356 wrote to memory of 4388 3356 XP-0EE37CC5.EXE 110 PID 3356 wrote to memory of 1180 3356 XP-0EE37CC5.EXE 111 PID 3356 wrote to memory of 1180 3356 XP-0EE37CC5.EXE 111 PID 3356 wrote to memory of 1180 3356 XP-0EE37CC5.EXE 111 PID 1180 wrote to memory of 2908 1180 XP-0EE37CC5.EXE 113 PID 1180 wrote to memory of 2908 1180 XP-0EE37CC5.EXE 113 PID 1180 wrote to memory of 2908 1180 XP-0EE37CC5.EXE 113 PID 1180 wrote to memory of 4548 1180 XP-0EE37CC5.EXE 114 PID 1180 wrote to memory of 4548 1180 XP-0EE37CC5.EXE 114 PID 1180 wrote to memory of 4548 1180 XP-0EE37CC5.EXE 114 PID 4548 wrote to memory of 4164 4548 XP-0EE37CC5.EXE 116 PID 4548 wrote to memory of 4164 4548 XP-0EE37CC5.EXE 116 PID 4548 wrote to memory of 4164 4548 XP-0EE37CC5.EXE 116 PID 4548 wrote to memory of 4972 4548 XP-0EE37CC5.EXE 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2530def488a99d27c611bc134e1e3934_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\2530def488a99d27c611bc134e1e3934_JaffaCakes1182⤵
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC53⤵
- System Location Discovery: System Language Discovery
PID:3424
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC54⤵
- System Location Discovery: System Language Discovery
PID:4936
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC55⤵
- System Location Discovery: System Language Discovery
PID:4308
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC56⤵
- System Location Discovery: System Language Discovery
PID:4004
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC57⤵
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC58⤵
- System Location Discovery: System Language Discovery
PID:4844
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC59⤵
- System Location Discovery: System Language Discovery
PID:4344
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC510⤵
- System Location Discovery: System Language Discovery
PID:4388
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC511⤵
- System Location Discovery: System Language Discovery
PID:2908
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE11⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC512⤵
- System Location Discovery: System Language Discovery
PID:4164
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE12⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC513⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE13⤵PID:3904
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC514⤵PID:3104
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE14⤵PID:3000
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC515⤵PID:2188
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE15⤵PID:1900
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC516⤵PID:60
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE16⤵PID:2432
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC517⤵PID:2588
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE17⤵PID:4352
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC518⤵PID:3900
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE18⤵PID:2576
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC519⤵PID:3216
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE19⤵PID:116
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC520⤵PID:1008
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE20⤵PID:3816
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC521⤵PID:3124
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE21⤵PID:4108
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC522⤵PID:1168
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE22⤵PID:4444
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC523⤵PID:3496
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE23⤵PID:996
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC524⤵PID:2648
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE24⤵PID:2796
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC525⤵PID:2168
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE25⤵PID:4736
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC526⤵PID:1072
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE26⤵PID:3980
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC527⤵PID:4868
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE27⤵PID:2168
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC528⤵PID:4372
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE28⤵PID:4168
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC529⤵PID:5216
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE29⤵PID:5272
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC530⤵PID:5384
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE30⤵PID:5436
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC531⤵PID:5552
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE31⤵PID:5616
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC532⤵PID:5764
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE32⤵PID:5840
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC533⤵PID:5948
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE33⤵PID:6024
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC534⤵PID:6136
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE34⤵PID:1808
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC535⤵PID:2708
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE35⤵PID:5476
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC536⤵PID:5672
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE36⤵PID:5160
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC537⤵PID:5896
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE37⤵PID:5812
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC538⤵PID:5200
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE38⤵PID:5380
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC539⤵PID:5600
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE39⤵PID:4108
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC540⤵PID:5084
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE40⤵PID:5544
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC541⤵PID:5388
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE41⤵PID:6136
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC542⤵PID:5636
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE42⤵PID:6156
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC543⤵PID:6276
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE43⤵PID:6360
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC544⤵PID:6480
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE44⤵PID:6528
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC545⤵PID:6648
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE45⤵PID:6700
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC546⤵PID:6812
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE46⤵PID:6900
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC547⤵PID:7020
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE47⤵PID:7072
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC548⤵PID:5876
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE48⤵PID:6332
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC549⤵PID:6344
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE49⤵PID:6560
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC550⤵PID:6740
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE50⤵PID:6192
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC551⤵PID:6936
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE51⤵PID:7028
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC552⤵PID:5832
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE52⤵PID:6792
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC553⤵PID:5960
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE53⤵PID:6692
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC554⤵PID:6480
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE54⤵PID:6892
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC555⤵PID:2948
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE55⤵PID:1980
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC556⤵PID:6532
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE56⤵PID:4988
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC557⤵PID:2204
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE57⤵PID:4764
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC558⤵PID:6940
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE58⤵PID:6892
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC559⤵PID:6500
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE59⤵PID:7200
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC560⤵PID:7308
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE60⤵PID:7356
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC561⤵PID:7480
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE61⤵PID:7520
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC562⤵PID:7632
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE62⤵PID:7672
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC563⤵PID:7756
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE63⤵PID:7808
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC564⤵PID:7916
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE64⤵PID:7960
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC565⤵PID:8052
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE65⤵PID:8092
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC566⤵PID:6288
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE66⤵PID:4584
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC567⤵PID:7388
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE67⤵PID:7336
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC568⤵PID:2300
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE68⤵PID:7516
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC569⤵PID:7648
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE69⤵PID:5340
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC570⤵PID:7732
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE70⤵PID:7948
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC571⤵PID:2016
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE71⤵PID:8036
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC572⤵PID:7200
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE72⤵PID:7220
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC573⤵PID:7340
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE73⤵PID:1768
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC574⤵PID:3004
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE74⤵PID:6288
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC575⤵PID:8120
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE75⤵PID:7904
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC576⤵PID:1852
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE76⤵PID:7628
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC577⤵PID:5768
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE77⤵PID:8120
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC578⤵PID:6320
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE78⤵PID:6992
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC579⤵PID:6436
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE79⤵PID:6388
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC580⤵PID:8204
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE80⤵PID:8248
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC581⤵PID:8360
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE81⤵PID:8400
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC582⤵PID:8528
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE82⤵PID:8564
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC583⤵PID:8680
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE83⤵PID:8724
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC584⤵PID:8824
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE84⤵PID:8880
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC585⤵PID:8980
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE85⤵PID:9028
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC586⤵PID:9128
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE86⤵PID:9164
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC587⤵PID:4132
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE87⤵PID:8120
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC588⤵PID:7708
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE88⤵PID:8388
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC589⤵PID:3576
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE89⤵PID:8512
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC590⤵PID:5072
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE90⤵PID:8664
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC591⤵PID:8728
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE91⤵PID:8276
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC592⤵PID:9032
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE92⤵PID:5096
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC593⤵PID:3660
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE93⤵PID:8536
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC594⤵PID:8964
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE94⤵PID:8768
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC595⤵PID:9004
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE95⤵PID:7664
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC596⤵PID:964
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE96⤵PID:6808
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC597⤵PID:9136
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE97⤵PID:7716
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC598⤵PID:9116
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE98⤵PID:8704
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC599⤵PID:8268
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE99⤵PID:7664
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5100⤵PID:1400
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE100⤵PID:7788
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5101⤵PID:6564
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE101⤵PID:6720
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5102⤵PID:5972
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE102⤵PID:6808
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5103⤵PID:9248
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE103⤵PID:9288
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5104⤵PID:9388
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE104⤵PID:9440
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5105⤵PID:9564
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE105⤵PID:9604
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5106⤵PID:9716
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE106⤵PID:9760
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5107⤵PID:9872
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE107⤵PID:9912
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5108⤵PID:10096
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE108⤵PID:10172
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5109⤵PID:3176
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE109⤵PID:2736
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5110⤵PID:9468
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE110⤵PID:9484
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5111⤵PID:9592
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE111⤵PID:5776
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5112⤵PID:9736
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE112⤵PID:9612
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5113⤵PID:4260
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE113⤵PID:10100
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5114⤵PID:6804
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE114⤵PID:6876
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5115⤵PID:4152
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE115⤵PID:7292
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5116⤵PID:3664
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE116⤵PID:3044
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5117⤵PID:9880
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE117⤵PID:4152
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5118⤵PID:7836
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE118⤵PID:9704
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5119⤵PID:5700
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE119⤵PID:10288
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5120⤵PID:10496
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE120⤵PID:10664
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5121⤵PID:10852
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE121⤵PID:10892
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC5122⤵PID:11044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-