5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

Analysis

max time kernel
151s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Size

405KB
MD5

2d8d691ccebd25cbbf801a519b964a5b
SHA1

1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc
SHA256

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd
SHA512

8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c
SSDEEP

12288:VkqanzfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqanhoAyx2Vc5

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exesvchost.exeServer.exeServer.exeServer.exeServer.exe5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe

Executes dropped EXE 21 IoCs

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

pid	process
468	Server.exe
1652	Server.exe
1288	Server.exe
1840	Server.exe
1324	Server.exe
728	Server.exe
960	Server.exe
1708	Server.exe
1500	Server.exe
1592	Server.exe
668	Server.exe
1576	Server.exe
1820	Server.exe
1044	Server.exe
1932	Server.exe
2028	Server.exe
1312	Server.exe
1184	Server.exe
1648	Server.exe
1536	Server.exe
1732	Server.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1308 explorer.exe

pid	process
1308	explorer.exe

Loads dropped DLL 42 IoCs

Processes:

svchost.exe

pid	process
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exesvchost.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exeServer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe"	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe

Drops file in System32 directory 64 IoCs

Processes:

explorer.exeServer.exeServer.exe5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exeServer.exeServer.exeServer.exeServer.exeexplorer.exeServer.exeServer.exeexplorer.exeServer.exeServer.exeexplorer.exeexplorer.exeServer.exeexplorer.exeexplorer.exeServer.exeServer.exeServer.exeexplorer.exeexplorer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exesvchost.exeServer.exe

description	pid	process	target process
PID 1348 wrote to memory of 1284	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1284	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1284	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1284	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1284	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 240	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 240	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 240	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 240	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1308	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	explorer.exe
PID 1348 wrote to memory of 1308	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	explorer.exe
PID 1348 wrote to memory of 1308	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	explorer.exe
PID 1348 wrote to memory of 1308	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	explorer.exe
PID 1348 wrote to memory of 1308	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	explorer.exe
PID 1348 wrote to memory of 736	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 736	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 736	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 736	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 732	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 732	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 732	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 732	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1928	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1928	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1928	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1928	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 788	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 788	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 788	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 788	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1756	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1756	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1756	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1756	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1924	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1924	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1924	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1924	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1716	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1716	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1716	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1716	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1532	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1532	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1532	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1532	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1796	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1796	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1796	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1796	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 268	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 268	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 268	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 268	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1284 wrote to memory of 468	1284	svchost.exe	Server.exe
PID 1284 wrote to memory of 468	1284	svchost.exe	Server.exe
PID 1284 wrote to memory of 468	1284	svchost.exe	Server.exe
PID 1284 wrote to memory of 468	1284	svchost.exe	Server.exe
PID 1348 wrote to memory of 1640	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1640	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1640	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 1348 wrote to memory of 1640	1348	5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe	svchost.exe
PID 468 wrote to memory of 1680	468	Server.exe	svchost.exe
PID 468 wrote to memory of 1680	468	Server.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe
"C:\Users\Admin\AppData\Local\Temp\5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1680

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:432

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:324

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1652

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:876

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1408

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1688

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1288

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1036

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1364

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1840

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:336

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1040

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1580

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1324

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1572

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1240

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1800

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:728

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:664

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:948

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1532

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:960

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1716

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1796

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1044

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1708

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1860

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1680

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:876

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1500

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1852

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1636

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:884

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1592

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:652

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1272

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:668

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1184

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1964

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1560

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1576

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:672

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1544

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:528

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1820

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1344

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1744

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:564

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1044

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:584

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1620

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1732

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1932

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:924

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1316

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1236

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2028

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:2040

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1580

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1524

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1312

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1520

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1800

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1416

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
PID:1184

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:964

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1616

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:2008

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1648

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1756

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:1688

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1536

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:520

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
PID:1248

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:316

C:\Windows\SysWOW64\InstallDir\Server.exe
"C:\Windows\system32\InstallDir\Server.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1732

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:916

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1156

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:240

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
- Deletes itself
PID:1308

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:736

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:732

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1928

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:788

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1756

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1924

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1716

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1532

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1796

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:268

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1640

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
afaa7de1876bfefe0a9ededd4212c7e9

SHA1
b0e4684bf4d0649ba1188b78baa17b298416f78a

SHA256
69a8f0a5d70714327e874d771187471d498a603123840eea8318924dbe24c2a1

SHA512
17e4156237e84f4fe0f7a1a171cb80811e100d2542bf215f71c8614cd3d8b0f6db19d59854c1bd69e44662252b7317544b33df1c06ef568dafede30e29bb01ab

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pS7W365H8DNcB\pS7W365H8DNcB.nfo
Filesize
3KB

MD5
cf969d0638b3f59b2c8c1ae4da1b1f3a

SHA1
99d5e27b01ac8cfe53a7472b18213ca89a26baf0

SHA256
8ee2c45dc77a59a1d91e83ead20cbbec1e0fd0a64d9eb7cb35e2c5f0efb1dd73

SHA512
67d73f4648d0b7cb55362771568923d03f1a8538f484dbe26b17400162298e56f376eb89250c94ca74a84b4904b3186d9b2ddb927222a71f5d6dddf7f47b134a

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
C:\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
\Windows\SysWOW64\InstallDir\Server.exe
Filesize
405KB

MD5
2d8d691ccebd25cbbf801a519b964a5b

SHA1
1af7a3d27ff8567f9f64bb94bdd4fbdb10c8d0bc

SHA256
5e6f2307292e2044bb2337444709d928c7cf90a8ebcf4fa7947451007fff71cd

SHA512
8d8005199f698271d28a160ded7e439f1f278a608b5a5d7dc3b1df91c1c449a88f6808ab6c2dbb342656c8eaea9d7b68375af7e18502afb0acf04156e5e5b50c

Download Submit
memory/432-75-0x0000000000000000-mapping.dmp

Download
memory/432-78-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/468-69-0x0000000000000000-mapping.dmp

Download
memory/652-190-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/652-187-0x0000000000000000-mapping.dmp

Download
memory/668-193-0x0000000000000000-mapping.dmp

Download
memory/728-131-0x0000000000000000-mapping.dmp

Download
memory/948-137-0x0000000000000000-mapping.dmp

Download
memory/948-140-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/960-143-0x0000000000000000-mapping.dmp

Download
memory/1036-100-0x0000000000000000-mapping.dmp

Download
memory/1036-103-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1040-115-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1040-112-0x0000000000000000-mapping.dmp

Download
memory/1044-231-0x0000000000000000-mapping.dmp

Download
memory/1184-266-0x0000000000000000-mapping.dmp

Download
memory/1240-128-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1240-125-0x0000000000000000-mapping.dmp

Download
memory/1248-289-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1248-286-0x0000000000000000-mapping.dmp

Download
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1284-60-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1288-93-0x0000000000000000-mapping.dmp

Download
memory/1308-63-0x0000000000000000-mapping.dmp

Download
memory/1308-66-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1308-65-0x0000000074791000-0x0000000074793000-memory.dmp

Filesize
8KB

Download
memory/1312-258-0x0000000000000000-mapping.dmp

Download
memory/1316-246-0x0000000000000000-mapping.dmp

Download
memory/1316-249-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1324-118-0x0000000000000000-mapping.dmp

Download
memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1408-87-0x0000000000000000-mapping.dmp

Download
memory/1408-90-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1500-168-0x0000000000000000-mapping.dmp

Download
memory/1536-282-0x0000000000000000-mapping.dmp

Download
memory/1544-215-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1544-212-0x0000000000000000-mapping.dmp

Download
memory/1576-206-0x0000000000000000-mapping.dmp

Download
memory/1580-257-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1580-254-0x0000000000000000-mapping.dmp

Download
memory/1592-181-0x0000000000000000-mapping.dmp

Download
memory/1616-273-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1616-270-0x0000000000000000-mapping.dmp

Download
memory/1620-240-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1620-237-0x0000000000000000-mapping.dmp

Download
memory/1636-175-0x0000000000000000-mapping.dmp

Download
memory/1636-178-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1648-274-0x0000000000000000-mapping.dmp

Download
memory/1652-81-0x0000000000000000-mapping.dmp

Download
memory/1680-162-0x0000000000000000-mapping.dmp

Download
memory/1680-165-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1708-156-0x0000000000000000-mapping.dmp

Download
memory/1732-290-0x0000000000000000-mapping.dmp

Download
memory/1744-225-0x0000000000000000-mapping.dmp

Download
memory/1744-228-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1756-281-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1756-278-0x0000000000000000-mapping.dmp

Download
memory/1796-153-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1796-150-0x0000000000000000-mapping.dmp

Download
memory/1800-265-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1800-262-0x0000000000000000-mapping.dmp

Download
memory/1820-218-0x0000000000000000-mapping.dmp

Download
memory/1840-106-0x0000000000000000-mapping.dmp

Download
memory/1932-242-0x0000000000000000-mapping.dmp

Download
memory/1964-200-0x0000000000000000-mapping.dmp

Download
memory/1964-203-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2028-250-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads