cycbot | e46a467fb47a2a044d7588f93a4cd8b6bb1083574044e903b69be5eda4054a9d

Analysis

max time kernel
8s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
24/10/2025, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe
Size 170KB
Sample251024-xqyn5sbw2f
SHA256 e46a467fb47a2a044d7588f93a4cd8b6bb1083574044e903b69be5eda4054a9d
MD5 30f81cf9147a741cb2a509b991e52643
SHA1 a404c8f8741e548734b7a9669a9cdd24892008fc
SHA512 e22f43ddf175b3a6c3cbf944619536f49688d2bc27b3ef9c6e5a1115470837ccd8040b529f552bc87c35f05c2c7af4a79fed9d05fbd5b05bbbe52f1f746775c9
SSDEEP 3072:nSqmDtbBl4mHZahYTZKv3sZCbZKFYQ8L0vB+P/rq1dbxt5kQ:nbSLBHZahcZKkyKFYhLuxxt5kQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

http://worldorderlive.com
http://rumperstumprs.com
http://transaerosystems.com
http://freeridershools.com
http://ourbigdrophills.com
http://mydbonlineaccess.com
http://onlinepdahelpforyou.com
http://remarkreddomas.com
http://transfersakkonline.com
http://backupdomaintolevel.com

Attributes

payload_url
http://armoredlegion.com/305986.png

http://armoredlegion.com/16354.png

http://armoredlegion.com/716354_m61.png

http://mektek.net/thelab/wiley.jpg

http://knowledgesutra.com/img/temp/hi.cgi

http://knowledgesutra.com/img/temp/head.png

http://battleon.com/134.gif

http://battleon.com/132.gif

http://battleon.com/133.gif

http://browsermmorpg.com/images/cpc.png

http://browsermmorpg.com/images/cpc2.png

http://browsermmorpg.com/img/intel.gif

http://browsermmorpg.com/img/intel.jpg

http://012webpages.com/christian12.jpg

http://012webpages.com/christian13.jpg

http://012webpages.com/christian14.jpg

http://tri-countymech.com/g/livechat.png

http://tri-countymech.com/g/logo.png

http://tri-countymech.com/g/133.jpg

http://tri-countymech.com/g/134.jpg

http://electronicstheory.com/pics/valley.png

http://electronicstheory.com/pics/sun.png

http://classicbattletech.com/lhous3.gif

http://classicbattletech.com/lhous4.gif

http://classicbattletech.com/lhous5.gif

http://classicbattletech.com/lhous6.gif

http://engineeringcrossing.com/images/misc/23525.png

http://engineeringcrossing.com/images/misc/64646.png

http://xprstats.com/images/logo.png

http://%s/s.php?c=121&id=%s

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/5712-12-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4324-73-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/5948-75-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4324-147-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\C9127\\FBEE9.exe"	JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5712-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4324-73-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/5948-75-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4324-147-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\Registry\User\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 8 IoCs

pid	Process
3076	explorer.exe
5176	explorer.exe
3324	explorer.exe
4620	explorer.exe
4596	explorer.exe
4192	explorer.exe
244	explorer.exe
3360	explorer.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3076	explorer.exe
3076	explorer.exe
5176	explorer.exe
5176	explorer.exe
3324	explorer.exe
3324	explorer.exe
4620	explorer.exe
4620	explorer.exe
4596	explorer.exe
4596	explorer.exe
4192	explorer.exe
4192	explorer.exe
244	explorer.exe
244	explorer.exe
3360	explorer.exe
3360	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5712	4324	JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe	78
PID 4324 wrote to memory of 5712	4324	JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe	78
PID 4324 wrote to memory of 5712	4324	JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe	78

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe startC:\Program Files (x86)\LP\E96C\999.exe%C:\Program Files (x86)\LP\E96C
  2⤵
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe startC:\Program Files (x86)\27344\lvvm.exe%C:\Program Files (x86)\27344
  2⤵
  PID:5948

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:3420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4620

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4596

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:2228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:244

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5032

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:800

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4180

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4684

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2216

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1932

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1124

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5468

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1320

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5312

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2784

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:3384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4104

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1796

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4548

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4008

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5808

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5824

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1068

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:3764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1132

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6184

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6400

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6612

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6828

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7048

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:2924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6284

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5884

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6228

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6932

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6964

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7356

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7568

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7780

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7984

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6524

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7556

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7960

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7408

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4084

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7344

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8212

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8432

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8652

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8856

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9072

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6744

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8580

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9036

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8540

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8196

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9392

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9600

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9832

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10040

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10232

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9828

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10204

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:2316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9816

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9944

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5064

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6452

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10276

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10464

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10688

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10916

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11128

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9988

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3424

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11052

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5776

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:10996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10852

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10856

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5240

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8524

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11396

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11432

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11676

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11888

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12108

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1924

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4660

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1200

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1928

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:3908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1120

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3100

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3964

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9924

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2628

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12328

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12524

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12768

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13004

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13212

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6356

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12648

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7188

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13280

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:12840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9260

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:8056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12852

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:6976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13288

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13484

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13724

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13968

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14108

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11036

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10680

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13940

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13816

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7560

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:12660

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7716

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:7888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8648

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14416

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14672

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14800

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15068

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15296

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:2692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:13600

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14624

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:11588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14972

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:9484

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:14436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14596

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:14612

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15024

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15176

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15452

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15700

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15928

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16128

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16288

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15516

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15472

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16016

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:4788

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16292

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6104

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:1684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16176

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:15876

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16316

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11736

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:13452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11084

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:5520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3256

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:15432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4624

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:3864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4960

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C9127\FBEE9.exe
1⤵
PID:16580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7344.912

Path C:\Users\Admin\AppData\Roaming\C9127\7344.912
Size 1KB
SHA256 32ca8acb66f2bb97a5202d3ff4016ea88f4cbf40ae84891bb6e67c7316711c7c
MD5 398196ba5335fc94a04b5ba2476cc5d5
SHA1 06f8f60efbedeb706be1097fa155b2700fc4941e
SHA512 f92d64c7350dd543bb79b769f0ad6116280c55a5dfb4621c4486cf8e946269ee5df3f45e02564104c10bb73444c012edb1912464d3b8956148ec55f83202f657
MD5 SHA1 SHA512

Submit Download

7344.912

Path C:\Users\Admin\AppData\Roaming\C9127\7344.912
Size 600B
SHA256 65041dd7627f65386adab56cb432a0d42f2c5f4a82c98dae668608630b77b762
MD5 c8e02b2415f42dae291535026e27c09d
SHA1 8eeabe1d69aa33f996a0f6cb2f2eada0fa1cce23
SHA512 de442ee61000860e7ed424b21913d75ebec8eb05f3c78c40606d490af6a6c2cc6fe2f6a8e2acaaf158f6119d95e78b5e444b81f1f25d17a40aa1d512b670ce60
MD5 SHA1 SHA512

Submit Download

7344.912

Path C:\Users\Admin\AppData\Roaming\C9127\7344.912
Size 996B
SHA256 5778bc640bd34e8a296d052338fc6c393935e57071dfe7cb8f6baa406e689214
MD5 b2b146852cd9e29ed8508a25cc8ab631
SHA1 22164529efe74b2a3312bc491db0b2963e5239cf
SHA512 b05c00fba340f7afb33d21d0542302077d86c7c05b8c0d1cb51ba2cd767612c24e268225dc770790f525ab92f144c2c1c325475d504c0314ea406e59d7f2dc50
MD5 SHA1 SHA512

Submit Download

memory/4324-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

Download

memory/4324-13-0x00000000005A0000-0x00000000006A0000-memory.dmp

Download

memory/4324-73-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/4324-147-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/5712-11-0x0000000000630000-0x0000000000730000-memory.dmp

Download

memory/5712-12-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/5948-75-0x0000000000400000-0x0000000000491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads