998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
Size

428KB
MD5

fcb7d8886bb2bcad2a96bb489309ee70
SHA1

d3e3c19494a359d41f048c2de6e6c4bed191d198
SHA256

998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab
SHA512

4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287
SSDEEP

6144:XWnU99gfZCgfRvd8mhd2FkVcAMNn18hhzdyeeaMblnh3X2mS5YeEoAsnH:G+8JvdB32FKcAOyJyJaSV2m27tH

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 56 IoCs

pid	Process
1808	Server.exe
1372	Server.exe
696	Server.exe
1936	Server.exe
764	Server.exe
920	Server.exe
1608	Server.exe
1028	Server.exe
2028	Server.exe
1368	Server.exe
796	Server.exe
320	Server.exe
956	Server.exe
1296	Server.exe
2040	Server.exe
824	Server.exe
1572	Server.exe
1144	Server.exe
1648	Server.exe
1776	Server.exe
2004	Server.exe
1704	Server.exe
1384	Server.exe
840	Server.exe
1032	Server.exe
556	Server.exe
1600	Server.exe
1612	Server.exe
624	Server.exe
1712	Server.exe
932	Server.exe
888	Server.exe
1764	Server.exe
628	Server.exe
948	Server.exe
1200	Server.exe
1456	Server.exe
760	Server.exe
1108	Server.exe
1340	Server.exe
1368	Server.exe
1648	Server.exe
1628	Server.exe
1912	Server.exe
1504	Server.exe
1044	Server.exe
956	Server.exe
1932	Server.exe
1888	Server.exe
1392	Server.exe
680	Server.exe
1224	Server.exe
828	Server.exe
932	Server.exe
832	Server.exe
1928	Server.exe

Modifies Installed Components in the registry 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-72-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1724-75-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1724-77-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1724-82-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1724-83-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1724-84-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/1996-91-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/696-127-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/696-128-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral1/memory/696-129-0x0000000010000000-0x000000001031C000-memory.dmp	upx

Loads dropped DLL 20 IoCs

pid	Process
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe

Suspicious use of SetThreadContext 39 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 908 set thread context of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 1808 set thread context of 1372	1808	Server.exe	33
PID 1372 set thread context of 696	1372	Server.exe	36
PID 1936 set thread context of 764	1936	Server.exe	37
PID 764 set thread context of 920	764	Server.exe	41
PID 1608 set thread context of 1028	1608	Server.exe	43
PID 1028 set thread context of 2028	1028	Server.exe	46
PID 1368 set thread context of 796	1368	Server.exe	48
PID 796 set thread context of 320	796	Server.exe	50
PID 956 set thread context of 1296	956	Server.exe	53
PID 1296 set thread context of 2040	1296	Server.exe	56
PID 824 set thread context of 1572	824	Server.exe	58
PID 1572 set thread context of 1144	1572	Server.exe	61
PID 1648 set thread context of 1776	1648	Server.exe	63
PID 1776 set thread context of 2004	1776	Server.exe	66
PID 1704 set thread context of 1384	1704	Server.exe	68
PID 1384 set thread context of 840	1384	Server.exe	71
PID 1032 set thread context of 556	1032	Server.exe	73
PID 556 set thread context of 1600	556	Server.exe	76
PID 1612 set thread context of 624	1612	Server.exe	78
PID 624 set thread context of 1712	624	Server.exe	81
PID 932 set thread context of 888	932	Server.exe	83
PID 888 set thread context of 1764	888	Server.exe	86
PID 628 set thread context of 948	628	Server.exe	88
PID 948 set thread context of 1200	948	Server.exe	91
PID 1456 set thread context of 760	1456	Server.exe	93
PID 760 set thread context of 1108	760	Server.exe	96
PID 1340 set thread context of 1368	1340	Server.exe	98
PID 1368 set thread context of 1648	1368	Server.exe	101
PID 1628 set thread context of 1912	1628	Server.exe	103
PID 1912 set thread context of 1504	1912	Server.exe	106
PID 1044 set thread context of 956	1044	Server.exe	108
PID 956 set thread context of 1932	956	Server.exe	111
PID 1888 set thread context of 1392	1888	Server.exe	113
PID 1392 set thread context of 680	1392	Server.exe	116
PID 1224 set thread context of 828	1224	Server.exe	118
PID 828 set thread context of 932	828	Server.exe	121
PID 832 set thread context of 1928	832	Server.exe	123

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe
File created	C:\Windows\InstallDir\Server.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
1372	Server.exe
764	Server.exe
1028	Server.exe
796	Server.exe
1296	Server.exe
1572	Server.exe
1776	Server.exe
1384	Server.exe
556	Server.exe
624	Server.exe
888	Server.exe
948	Server.exe
760	Server.exe
1368	Server.exe
1912	Server.exe
956	Server.exe
1392	Server.exe
828	Server.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
696	Server.exe
920	Server.exe
2028	Server.exe
320	Server.exe
2040	Server.exe
1144	Server.exe
2004	Server.exe
840	Server.exe
1600	Server.exe
1712	Server.exe
1764	Server.exe
1200	Server.exe
1108	Server.exe
1648	Server.exe
1504	Server.exe
1932	Server.exe
680	Server.exe
932	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 368 wrote to memory of 908	368	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	27
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2036	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	28
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 2016	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	29
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 908 wrote to memory of 1724	908	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	30
PID 1724 wrote to memory of 1996	1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	31
PID 1724 wrote to memory of 1996	1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	31
PID 1724 wrote to memory of 1996	1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	31
PID 1724 wrote to memory of 1996	1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	31
PID 1724 wrote to memory of 1996	1724	998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe	31
PID 1996 wrote to memory of 1808	1996	svchost.exe	32
PID 1996 wrote to memory of 1808	1996	svchost.exe	32
PID 1996 wrote to memory of 1808	1996	svchost.exe	32
PID 1996 wrote to memory of 1808	1996	svchost.exe	32
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1808 wrote to memory of 1372	1808	Server.exe	33
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1652	1372	Server.exe	34
PID 1372 wrote to memory of 1480	1372	Server.exe	35
PID 1372 wrote to memory of 1480	1372	Server.exe	35

C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
"C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
  C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2036
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
    C:\Users\Admin\AppData\Local\Temp\998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab.exe
    3⤵
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Modifies Installed Components in the registry
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1808
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1480
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:696
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1936
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1608
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2028
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1368
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:332
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1880
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:956
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1904
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2040
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:824
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1516
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1144
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1648
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:940
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2004
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1704
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1808
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:840
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1032
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:944
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1600
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1612
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1892
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1712
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:932
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1864
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1764
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:628
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1312
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1200
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1456
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1884
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1108
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1340
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1032
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1648
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1628
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1504
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1044
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1932
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1888
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1076
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:680
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1224
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:880
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:932
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:832
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Executes dropped EXE
        
        PID:1928

C:\Windows\InstallDir\Server.exe
C:\Windows\InstallDir\Server.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:764
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:836
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1556
- C:\Windows\InstallDir\Server.exe
  C:\Windows\InstallDir\Server.exe
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
2d49520fc8d5ae92d4113d1a7037ef60

SHA1
ebc8459a779c3c744880c5f768a7d91f1b069716

SHA256
3163b7269eff431a947329228bd397bf9d2be8904dae67cff5311ab51b68dbeb

SHA512
ff21e5ae4573786f5baad1a9bc174178f56cd749b1c401d8263e32bc371c2580b84dd8dada6b97a4ce5013d0c5080b2b42113b8b98004c569949bba2c6d05968

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
\Windows\InstallDir\Server.exe

Filesize
428KB

MD5
fcb7d8886bb2bcad2a96bb489309ee70

SHA1
d3e3c19494a359d41f048c2de6e6c4bed191d198

SHA256
998d3a52cc3f57d434281e266e6cd55d227a02921a23e3fdf214f7083ee72aab

SHA512
4e3fb0ccc8985c74d30c7fdd31e2962856684bd31312cb0d0abc26d2fcd1291737de80540cf564cbee51034bda40bf5bf1df8f27804eafcca9fb10206f77e287

Download Submit
memory/320-249-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/320-250-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/556-425-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/556-436-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/624-474-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/696-130-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/696-127-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/696-128-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/696-129-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/696-131-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/696-132-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/760-580-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/760-590-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/764-153-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/764-164-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/796-243-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/796-232-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/840-404-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/840-403-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/888-514-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/888-503-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-59-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-55-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-58-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-80-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-54-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-69-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-60-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-61-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-63-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-65-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-68-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/908-57-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-70-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/908-67-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/920-172-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/920-170-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/920-171-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/948-552-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/956-692-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1028-193-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1028-204-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1108-596-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1108-595-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1144-328-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1144-327-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1200-558-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1200-559-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1296-272-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1296-282-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1368-618-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1368-624-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1372-125-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1384-397-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1504-663-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1572-310-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1572-321-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1600-443-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1600-442-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1648-630-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1648-629-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1712-481-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1712-479-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/1712-482-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1724-84-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-75-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-92-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1724-90-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1724-89-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/1724-83-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-82-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-71-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-72-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1724-77-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/1764-521-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1764-520-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1776-359-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1912-648-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1912-659-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1996-91-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/2004-365-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2004-366-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2028-210-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2028-211-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2040-288-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2040-289-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download