xtremerat | c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Size 19KB
Sample221014-lxedasabe9
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 60 IoCs

resource	yara_rule
behavioral2/memory/3808-136-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/444-138-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/444-141-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2356-143-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2356-146-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2620-147-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2620-151-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2908-153-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2908-156-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2768-158-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2768-161-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1308-163-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1308-166-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1312-168-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1312-171-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3720-173-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3720-176-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2596-178-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2596-181-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3372-182-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3372-186-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3208-188-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3208-191-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2108-193-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2108-196-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3184-198-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3184-201-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2244-203-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2244-206-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1344-208-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1344-211-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1680-213-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1680-216-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4512-217-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4512-221-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3152-223-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3152-226-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3960-228-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3960-231-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2292-233-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2292-236-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/964-238-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/964-241-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1948-243-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1948-246-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4308-248-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4308-251-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3888-252-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3888-256-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1712-258-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1712-261-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4600-263-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4600-266-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/5004-267-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/5004-271-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4268-273-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4268-276-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1680-278-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/1680-281-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/112-283-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 30 IoCs

pid	Process
444	Server.exe
2356	Server.exe
2620	Server.exe
2908	Server.exe
2768	Server.exe
1308	Server.exe
1312	Server.exe
3720	Server.exe
2596	Server.exe
3372	Server.exe
3208	Server.exe
2108	Server.exe
3184	Server.exe
2244	Server.exe
1344	Server.exe
1680	Server.exe
4512	Server.exe
3152	Server.exe
3960	Server.exe
2292	Server.exe
964	Server.exe
1948	Server.exe
4308	Server.exe
3888	Server.exe
1712	Server.exe
4600	Server.exe
5004	Server.exe
4268	Server.exe
1680	Server.exe
112	Server.exe

Modifies Installed Components in the registry 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GJ87HS0K-W327-O543-TDH4-S883QY2SU86J}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3808-132-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-134.dat	upx
behavioral2/files/0x0006000000022f58-135.dat	upx
behavioral2/memory/3808-136-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/444-138-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-140.dat	upx
behavioral2/memory/444-141-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2356-143-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-145.dat	upx
behavioral2/memory/2356-146-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2620-147-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-150.dat	upx
behavioral2/memory/2620-151-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2908-153-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-155.dat	upx
behavioral2/memory/2908-156-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2768-158-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-160.dat	upx
behavioral2/memory/2768-161-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1308-163-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-165.dat	upx
behavioral2/memory/1308-166-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1312-168-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-170.dat	upx
behavioral2/memory/1312-171-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3720-173-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-175.dat	upx
behavioral2/memory/3720-176-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2596-178-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-180.dat	upx
behavioral2/memory/2596-181-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3372-182-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-185.dat	upx
behavioral2/memory/3372-186-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3208-188-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-190.dat	upx
behavioral2/memory/3208-191-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2108-193-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-195.dat	upx
behavioral2/memory/2108-196-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3184-198-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-200.dat	upx
behavioral2/memory/3184-201-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2244-203-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-205.dat	upx
behavioral2/memory/2244-206-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1344-208-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/1344-211-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-210.dat	upx
behavioral2/memory/1680-213-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-215.dat	upx
behavioral2/memory/1680-216-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4512-217-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-220.dat	upx
behavioral2/memory/4512-221-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3152-223-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-225.dat	upx
behavioral2/memory/3152-226-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3960-228-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-230.dat	upx
behavioral2/memory/3960-231-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/2292-233-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/files/0x0006000000022f58-235.dat	upx
behavioral2/memory/2292-236-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Checks computer location settings 2 TTPs 30 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Server.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\InstallDir\Server.exe	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1016	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	78
PID 3808 wrote to memory of 1016	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	78
PID 3808 wrote to memory of 1016	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	78
PID 3808 wrote to memory of 1116	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	79
PID 3808 wrote to memory of 1116	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	79
PID 3808 wrote to memory of 1116	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	79
PID 3808 wrote to memory of 3600	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	80
PID 3808 wrote to memory of 3600	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	80
PID 3808 wrote to memory of 3600	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	80
PID 3808 wrote to memory of 1964	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	81
PID 3808 wrote to memory of 1964	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	81
PID 3808 wrote to memory of 1964	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	81
PID 3808 wrote to memory of 2860	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	83
PID 3808 wrote to memory of 2860	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	83
PID 3808 wrote to memory of 2860	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	83
PID 3808 wrote to memory of 3256	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	84
PID 3808 wrote to memory of 3256	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	84
PID 3808 wrote to memory of 3256	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	84
PID 3808 wrote to memory of 4880	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	87
PID 3808 wrote to memory of 4880	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	87
PID 3808 wrote to memory of 4880	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	87
PID 3808 wrote to memory of 3976	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	88
PID 3808 wrote to memory of 3976	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	88
PID 3808 wrote to memory of 444	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	91
PID 3808 wrote to memory of 444	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	91
PID 3808 wrote to memory of 444	3808	c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe	91
PID 444 wrote to memory of 5060	444	Server.exe	92
PID 444 wrote to memory of 5060	444	Server.exe	92
PID 444 wrote to memory of 5060	444	Server.exe	92
PID 444 wrote to memory of 1988	444	Server.exe	93
PID 444 wrote to memory of 1988	444	Server.exe	93
PID 444 wrote to memory of 1988	444	Server.exe	93
PID 444 wrote to memory of 4764	444	Server.exe	94
PID 444 wrote to memory of 4764	444	Server.exe	94
PID 444 wrote to memory of 4764	444	Server.exe	94
PID 444 wrote to memory of 5112	444	Server.exe	95
PID 444 wrote to memory of 5112	444	Server.exe	95
PID 444 wrote to memory of 5112	444	Server.exe	95
PID 444 wrote to memory of 4184	444	Server.exe	97
PID 444 wrote to memory of 4184	444	Server.exe	97
PID 444 wrote to memory of 4184	444	Server.exe	97
PID 444 wrote to memory of 4636	444	Server.exe	98
PID 444 wrote to memory of 4636	444	Server.exe	98
PID 444 wrote to memory of 4636	444	Server.exe	98
PID 444 wrote to memory of 1388	444	Server.exe	99
PID 444 wrote to memory of 1388	444	Server.exe	99
PID 444 wrote to memory of 1388	444	Server.exe	99
PID 444 wrote to memory of 952	444	Server.exe	100
PID 444 wrote to memory of 952	444	Server.exe	100
PID 444 wrote to memory of 2356	444	Server.exe	101
PID 444 wrote to memory of 2356	444	Server.exe	101
PID 444 wrote to memory of 2356	444	Server.exe	101
PID 2356 wrote to memory of 3384	2356	Server.exe	102
PID 2356 wrote to memory of 3384	2356	Server.exe	102
PID 2356 wrote to memory of 3384	2356	Server.exe	102
PID 2356 wrote to memory of 4496	2356	Server.exe	105
PID 2356 wrote to memory of 4496	2356	Server.exe	105
PID 2356 wrote to memory of 4496	2356	Server.exe	105
PID 2356 wrote to memory of 4200	2356	Server.exe	106
PID 2356 wrote to memory of 4200	2356	Server.exe	106
PID 2356 wrote to memory of 4200	2356	Server.exe	106
PID 2356 wrote to memory of 4152	2356	Server.exe	107
PID 2356 wrote to memory of 4152	2356	Server.exe	107
PID 2356 wrote to memory of 4152	2356	Server.exe	107

C:\Users\Admin\AppData\Local\Temp\c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe
"C:\Users\Admin\AppData\Local\Temp\c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3976
- C:\Windows\InstallDir\Server.exe
  "C:\Windows\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:952
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:344
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Modifies Installed Components in the registry
      Checks computer location settings
      Adds Run key to start application
      PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4596
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4680
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1504
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1536
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1844
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1468
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4776
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3740
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4936
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:444
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        14⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4076
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1672
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        16⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:1648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2472
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:1996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:1308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3536
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        18⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:1760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:60
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:1392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2420
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2764
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        20⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:5036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2844
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        21⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:3492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:3148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:4560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:3988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:816
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        22⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:2600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:2992
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        23⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:1944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:2296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:2800
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        24⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3220
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        25⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:1132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:5016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:2324
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        26⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:3372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:5056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:3276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:1968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:1684
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        27⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:2368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:1412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:3032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:3560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:2332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:2328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:2052
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        28⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:5004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:3056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:1500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        29⤵
        
        PID:692
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        29⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:2356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:4452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:3304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:1948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:1756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:3352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:1404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        30⤵
        
        PID:3068
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        30⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:2548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:4660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:2080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        31⤵
        
        PID:412
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        31⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:3444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:1712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:4768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        32⤵
        
        PID:3644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

uSqQa34fl.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uSqQa34fl.cfg
Size 1KB
SHA256 859e45e367400c78e917a1e5e404048bbff4f10ff32f22f8438d759c0404ad1f
MD5 da6ed007566bfda30af3a1fe5b88e4fc
SHA1 99afad9f8d31143ddfb9b5381dd4c7e09827bb59
SHA512 a13cbdc9b2070ca2c1321b19c5deae8a818f581cc322454efd848fd8c79eef50cc850b62289d47f368b0d6f9afeb64a8ad8420b05c7adcbdb861979df3706099
MD5 SHA1 SHA512

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Windows\InstallDir\Server.exe
Size 19KB
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-283-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/444-141-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/444-138-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/964-241-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/964-238-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1308-163-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1308-166-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1312-168-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1312-171-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1344-208-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1344-211-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1680-216-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1680-278-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1680-213-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1680-281-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1712-261-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1712-258-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1948-246-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/1948-243-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2108-196-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2108-193-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2244-203-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2244-206-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2292-236-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2292-233-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2356-146-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2356-143-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2596-181-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2596-178-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2620-151-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2620-147-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2768-161-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2768-158-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2908-156-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/2908-153-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3152-226-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3152-223-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3184-198-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3184-201-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3208-191-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3208-188-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3372-182-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3372-186-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3720-176-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3720-173-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3808-136-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3808-132-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3888-256-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3888-252-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3960-231-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/3960-228-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4268-273-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4268-276-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4308-248-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4308-251-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4512-221-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4512-217-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4600-263-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4600-266-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/5004-267-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/5004-271-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads