Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 05:15
General
-
Target
Server.exe
-
Size
93KB
-
MD5
edaf154b94f8808071e089661c89412e
-
SHA1
31b1c1eefe489f1f348002d5b01870b268b24ca0
-
SHA256
20184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
-
SHA512
8461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
Malware Config
Extracted
njrat
0.7d
HacKed By CobrA 217
Y29icmFzc3Nzc3Nzc3Nzcy5kZG5zLm5ldAStrikStrik:MTE3Nw==
3a080181c5938cd7611a562e79328fc0
-
reg_key
3a080181c5938cd7611a562e79328fc0
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Disables Task Manager via registry modification
-
Executes dropped EXE 39 IoCs
-
Modifies Windows Firewall 1 TTPs 58 IoCs
-
Checks computer location settings 2 TTPs 39 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 60 IoCs
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 20 IoCs
-
Drops file in Program Files directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE7⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE9⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"9⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE9⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"10⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE11⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"11⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE11⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"11⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"12⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE13⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"13⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE13⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"13⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE15⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"15⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE15⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"15⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"16⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE17⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"17⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE17⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"17⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"18⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE19⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"19⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE19⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"19⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"20⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE21⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"21⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE21⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"21⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"22⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE23⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"23⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE23⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"23⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"24⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE25⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"25⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE25⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"25⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"26⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE27⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"27⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE27⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"27⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"28⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE29⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"29⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE29⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"29⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"30⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE31⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE31⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"31⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"31⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"32⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE33⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"33⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE33⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"33⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"34⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE35⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"35⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE35⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"35⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"36⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE37⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE37⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"37⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"37⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"38⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE39⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"39⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE39⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"39⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE41⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Notepad.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Notepad.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Notepad.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Program Files (x86)\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Program Files (x86)\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Program Files (x86)\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.logFilesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.logFilesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Local\Temp\melt.txtFilesize
41B
MD5964ddaa3491c746b5ef7e7fb6b653384
SHA11bb95b5f8f514d2840cf399812631f2838979452
SHA256157eee8b1b5ad0c0beac03f59dc40c5326eae961d495cde8deb3625537810adb
SHA512a06d3735cc7e5c707b52082a061eeb0fd2298c7bdc9ff476de1d0062ae716a6ed757d3aba6e7f36d76dbe0e69349c6bef7e3f840c0516500ddd0bf0d90497752
-
C:\Users\Admin\AppData\Local\Temp\melt.txtFilesize
41B
MD5964ddaa3491c746b5ef7e7fb6b653384
SHA11bb95b5f8f514d2840cf399812631f2838979452
SHA256157eee8b1b5ad0c0beac03f59dc40c5326eae961d495cde8deb3625537810adb
SHA512a06d3735cc7e5c707b52082a061eeb0fd2298c7bdc9ff476de1d0062ae716a6ed757d3aba6e7f36d76dbe0e69349c6bef7e3f840c0516500ddd0bf0d90497752
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3a080181c5938cd7611a562e79328fc0Windows Update.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3a080181c5938cd7611a562e79328fc0Windows Update.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3a080181c5938cd7611a562e79328fc0Windows Update.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD53eb8a6afa534fadc147aa70dea76e863
SHA103b827d99098f69c9f126679598f7166c99d1624
SHA256d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
SHA512b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Desktop\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Desktop\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Desktop\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Documents\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Documents\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Documents\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Favorites\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Favorites\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Users\Admin\Favorites\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Windows\SysWOW64\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Windows\SysWOW64\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
C:\Windows\SysWOW64\Explower.exeFilesize
93KB
MD5edaf154b94f8808071e089661c89412e
SHA131b1c1eefe489f1f348002d5b01870b268b24ca0
SHA25620184619a871dccba37b64770f1ce258c11b1406302b7d8f0a1c2957c4bcd393
SHA5128461f866a721daf7d78e4b942f6c73a89db84edc3fdef34aa5e2fc4f5bb5d43c57bba9b7d164819cd2fd9f155e946439e9a9ab1ff9bcbc5f1dbedf406314c0ae
-
memory/208-248-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/208-250-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/208-246-0x0000000000000000-mapping.dmp
-
memory/312-147-0x0000000000000000-mapping.dmp
-
memory/312-152-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/312-174-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/432-244-0x0000000000000000-mapping.dmp
-
memory/840-176-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/840-170-0x0000000000000000-mapping.dmp
-
memory/840-180-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/840-253-0x0000000000000000-mapping.dmp
-
memory/844-297-0x0000000000000000-mapping.dmp
-
memory/924-228-0x0000000000000000-mapping.dmp
-
memory/924-230-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/924-232-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/968-303-0x0000000000000000-mapping.dmp
-
memory/968-309-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/968-305-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1072-254-0x0000000000000000-mapping.dmp
-
memory/1224-300-0x0000000000000000-mapping.dmp
-
memory/1224-304-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1224-302-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1420-231-0x0000000000000000-mapping.dmp
-
memory/1420-238-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1420-233-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1524-312-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1524-313-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1572-307-0x0000000000000000-mapping.dmp
-
memory/1604-287-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1604-292-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1604-285-0x0000000000000000-mapping.dmp
-
memory/1660-318-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1660-319-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1708-291-0x0000000000000000-mapping.dmp
-
memory/1708-295-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1708-293-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1720-306-0x0000000000000000-mapping.dmp
-
memory/1860-200-0x0000000000000000-mapping.dmp
-
memory/1860-205-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1860-209-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1888-311-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1888-310-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/1984-261-0x0000000000000000-mapping.dmp
-
memory/2072-245-0x0000000000000000-mapping.dmp
-
memory/2132-167-0x0000000000000000-mapping.dmp
-
memory/2296-243-0x0000000000000000-mapping.dmp
-
memory/2336-263-0x0000000000000000-mapping.dmp
-
memory/2372-256-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2372-251-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2372-249-0x0000000000000000-mapping.dmp
-
memory/2408-315-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2408-317-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2452-262-0x0000000000000000-mapping.dmp
-
memory/2848-139-0x0000000000000000-mapping.dmp
-
memory/2884-146-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2884-141-0x0000000000000000-mapping.dmp
-
memory/2884-150-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2888-247-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2888-240-0x0000000000000000-mapping.dmp
-
memory/2888-242-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2948-288-0x0000000000000000-mapping.dmp
-
memory/3000-283-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3000-276-0x0000000000000000-mapping.dmp
-
memory/3000-278-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3092-271-0x0000000000000000-mapping.dmp
-
memory/3108-212-0x0000000000000000-mapping.dmp
-
memory/3112-235-0x0000000000000000-mapping.dmp
-
memory/3144-272-0x0000000000000000-mapping.dmp
-
memory/3156-236-0x0000000000000000-mapping.dmp
-
memory/3164-282-0x0000000000000000-mapping.dmp
-
memory/3164-284-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3164-286-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3192-203-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3192-181-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3192-177-0x0000000000000000-mapping.dmp
-
memory/3264-275-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3264-273-0x0000000000000000-mapping.dmp
-
memory/3264-277-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3308-211-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3308-206-0x0000000000000000-mapping.dmp
-
memory/3308-229-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3324-137-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3324-144-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3324-131-0x0000000000000000-mapping.dmp
-
memory/3400-279-0x0000000000000000-mapping.dmp
-
memory/3460-321-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3460-320-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3464-267-0x0000000000000000-mapping.dmp
-
memory/3464-274-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3464-269-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3500-237-0x0000000000000000-mapping.dmp
-
memory/3500-241-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3500-239-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3504-281-0x0000000000000000-mapping.dmp
-
memory/3516-296-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3516-294-0x0000000000000000-mapping.dmp
-
memory/3516-301-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3532-140-0x0000000000000000-mapping.dmp
-
memory/3720-280-0x0000000000000000-mapping.dmp
-
memory/3808-198-0x0000000000000000-mapping.dmp
-
memory/4040-226-0x0000000000000000-mapping.dmp
-
memory/4052-227-0x0000000000000000-mapping.dmp
-
memory/4060-298-0x0000000000000000-mapping.dmp
-
memory/4076-183-0x0000000000000000-mapping.dmp
-
memory/4084-314-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4084-316-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4228-234-0x0000000000000000-mapping.dmp
-
memory/4240-308-0x0000000000000000-mapping.dmp
-
memory/4332-138-0x0000000000000000-mapping.dmp
-
memory/4440-255-0x0000000000000000-mapping.dmp
-
memory/4440-257-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4440-259-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4492-153-0x0000000000000000-mapping.dmp
-
memory/4496-290-0x0000000000000000-mapping.dmp
-
memory/4636-264-0x0000000000000000-mapping.dmp
-
memory/4636-266-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4636-268-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4648-197-0x0000000000000000-mapping.dmp
-
memory/4808-252-0x0000000000000000-mapping.dmp
-
memory/4828-299-0x0000000000000000-mapping.dmp
-
memory/4884-168-0x0000000000000000-mapping.dmp
-
memory/4916-130-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4916-135-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4980-289-0x0000000000000000-mapping.dmp
-
memory/4988-258-0x0000000000000000-mapping.dmp
-
memory/4988-265-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/4988-260-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/5008-270-0x0000000000000000-mapping.dmp