xtremerat | 3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

Analysis

max time kernel
161s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
Size

156KB
MD5

7b2f715c1c3da8cfed84c2bff35676d9
SHA1

2b6d2a5b6110e6900b191123f940487040a770aa
SHA256

3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754
SHA512

683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d
SSDEEP

3072:DXgnMZMAht0Nht4pr9NJWqrkuBIH4ax+9gnUhPSNNyWcHzYqPL0BbNNQ8:sCMOpLIqNBgPCTHzYjBb3z

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

sucamilla.no-ip.org

Signatures

Detect XtremeRAT payload 45 IoCs

resource	yara_rule
behavioral2/memory/2392-140-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/2392-141-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1136-142-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/1136-144-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/2392-145-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/2780-156-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/2780-158-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/2780-159-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3280-169-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3280-172-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3280-173-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1252-186-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1252-187-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1736-200-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1736-201-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4204-214-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4204-215-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3048-228-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3048-229-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4476-242-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4476-243-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1512-255-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1512-257-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4220-271-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4220-272-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3752-286-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3752-287-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3356-300-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3356-301-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3216-314-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3216-315-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/5080-328-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/5080-329-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3192-342-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/3192-343-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4264-355-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4264-357-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1552-369-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1552-371-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1888-384-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/1888-385-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4596-398-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4596-399-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4524-412-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat
behavioral2/memory/4524-413-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 44 IoCs

pid	Process
3340	Server.exe
2780	Server.exe
1784	Server.exe
3280	Server.exe
4580	Server.exe
1252	Server.exe
4516	Server.exe
1736	Server.exe
1560	Server.exe
4204	Server.exe
3192	Server.exe
3048	Server.exe
5092	Server.exe
4476	Server.exe
1232	Server.exe
1512	Server.exe
3776	Server.exe
4220	Server.exe
1624	Server.exe
3752	Server.exe
4916	Server.exe
3356	Server.exe
3280	Server.exe
3216	Server.exe
3972	Server.exe
5080	Server.exe
1276	Server.exe
3192	Server.exe
4444	Server.exe
4264	Server.exe
4208	Server.exe
1552	Server.exe
1652	Server.exe
1888	Server.exe
3404	Server.exe
4596	Server.exe
4952	Server.exe
4524	Server.exe
3592	Server.exe
1400	Server.exe
2448	Server.exe
1124	Server.exe
4928	Server.exe
4960	Server.exe

Modifies Installed Components in the registry 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{228F4T86-Y18M-EL02-7R15-W523M71525T7}	Server.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2392-136-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2392-139-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2392-140-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2392-141-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1136-144-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2392-145-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2780-155-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2780-156-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2780-158-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/2780-159-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3280-168-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3280-169-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3280-172-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3280-173-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1252-186-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1252-187-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1736-200-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1736-201-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4204-214-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4204-215-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3048-228-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3048-229-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4476-242-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4476-243-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1512-255-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1512-257-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4220-271-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4220-272-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3752-286-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3752-287-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3356-300-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3356-301-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3216-314-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3216-315-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/5080-328-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/5080-329-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3192-342-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/3192-343-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4264-355-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4264-357-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1552-369-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1552-371-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1888-384-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/1888-385-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4596-398-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4596-399-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4524-412-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4524-413-0x0000000013140000-0x000000001315F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe
File created	C:\Windows\SysWOW64\	Server.exe

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 3340 set thread context of 2780	3340	Server.exe	97
PID 1784 set thread context of 3280	1784	Server.exe	107
PID 4580 set thread context of 1252	4580	Server.exe	117
PID 4516 set thread context of 1736	4516	Server.exe	127
PID 1560 set thread context of 4204	1560	Server.exe	137
PID 3192 set thread context of 3048	3192	Server.exe	147
PID 5092 set thread context of 4476	5092	Server.exe	157
PID 1232 set thread context of 1512	1232	Server.exe	167
PID 3776 set thread context of 4220	3776	Server.exe	177
PID 1624 set thread context of 3752	1624	Server.exe	187
PID 4916 set thread context of 3356	4916	Server.exe	197
PID 3280 set thread context of 3216	3280	Server.exe	207
PID 3972 set thread context of 5080	3972	Server.exe	217
PID 1276 set thread context of 3192	1276	Server.exe	227
PID 4444 set thread context of 4264	4444	Server.exe	237
PID 4208 set thread context of 1552	4208	Server.exe	247
PID 1652 set thread context of 1888	1652	Server.exe	257
PID 3404 set thread context of 4596	3404	Server.exe	267
PID 4952 set thread context of 4524	4952	Server.exe	277
PID 3592 set thread context of 1400	3592	Server.exe	287
PID 2448 set thread context of 1124	2448	Server.exe	297
PID 4928 set thread context of 4960	4928	Server.exe	307

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File created	C:\Windows\InstallDir\Server.exe	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
3340	Server.exe
1784	Server.exe
4580	Server.exe
4516	Server.exe
1560	Server.exe
3192	Server.exe
5092	Server.exe
1232	Server.exe
3776	Server.exe
1624	Server.exe
4916	Server.exe
3280	Server.exe
3972	Server.exe
1276	Server.exe
4444	Server.exe
4208	Server.exe
1652	Server.exe
3404	Server.exe
4952	Server.exe
3592	Server.exe
2448	Server.exe
4928	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2384 wrote to memory of 2392	2384	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	78
PID 2392 wrote to memory of 1136	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	79
PID 2392 wrote to memory of 1136	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	79
PID 2392 wrote to memory of 1136	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	79
PID 2392 wrote to memory of 1136	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	79
PID 2392 wrote to memory of 4976	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	80
PID 2392 wrote to memory of 4976	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	80
PID 2392 wrote to memory of 4976	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	80
PID 2392 wrote to memory of 4972	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	81
PID 2392 wrote to memory of 4972	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	81
PID 2392 wrote to memory of 4972	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	81
PID 2392 wrote to memory of 4880	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	82
PID 2392 wrote to memory of 4880	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	82
PID 2392 wrote to memory of 4880	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	82
PID 2392 wrote to memory of 3500	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	83
PID 2392 wrote to memory of 3500	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	83
PID 2392 wrote to memory of 3500	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	83
PID 2392 wrote to memory of 4964	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	84
PID 2392 wrote to memory of 4964	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	84
PID 2392 wrote to memory of 4964	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	84
PID 2392 wrote to memory of 5008	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	85
PID 2392 wrote to memory of 5008	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	85
PID 2392 wrote to memory of 5008	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	85
PID 2392 wrote to memory of 1492	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	86
PID 2392 wrote to memory of 1492	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	86
PID 2392 wrote to memory of 1492	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	86
PID 2392 wrote to memory of 2284	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	87
PID 2392 wrote to memory of 2284	2392	3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe	87
PID 1136 wrote to memory of 3340	1136	svchost.exe	96
PID 1136 wrote to memory of 3340	1136	svchost.exe	96
PID 1136 wrote to memory of 3340	1136	svchost.exe	96
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 3340 wrote to memory of 2780	3340	Server.exe	97
PID 2780 wrote to memory of 4852	2780	Server.exe	98
PID 2780 wrote to memory of 4852	2780	Server.exe	98
PID 2780 wrote to memory of 4852	2780	Server.exe	98
PID 2780 wrote to memory of 2980	2780	Server.exe	99
PID 2780 wrote to memory of 2980	2780	Server.exe	99
PID 2780 wrote to memory of 2980	2780	Server.exe	99
PID 2780 wrote to memory of 2908	2780	Server.exe	100
PID 2780 wrote to memory of 2908	2780	Server.exe	100
PID 2780 wrote to memory of 2908	2780	Server.exe	100
PID 2780 wrote to memory of 3596	2780	Server.exe	101
PID 2780 wrote to memory of 3596	2780	Server.exe	101
PID 2780 wrote to memory of 3596	2780	Server.exe	101
PID 2780 wrote to memory of 2440	2780	Server.exe	102
PID 2780 wrote to memory of 2440	2780	Server.exe	102
PID 2780 wrote to memory of 2440	2780	Server.exe	102
PID 2780 wrote to memory of 968	2780	Server.exe	103
PID 2780 wrote to memory of 968	2780	Server.exe	103
PID 2780 wrote to memory of 968	2780	Server.exe	103

C:\Users\Admin\AppData\Local\Temp\3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
"C:\Users\Admin\AppData\Local\Temp\3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754.exe
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3340
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3240
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2516
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4580
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4464
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1160
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3432
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2972
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3192
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4840
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:5092
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:912
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4032
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5072
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4780
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3320
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4000
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3280
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:60
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4252
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3972
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:5080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4356
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1276
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3564
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1512
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4208
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4060
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4796
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2152
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4028
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3868
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3592
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1308
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3224
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Windows\InstallDir\Server.exe
        
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1212
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\[email protected]

Filesize
1KB

MD5
01a01093343cab2866159c9f22a681ab

SHA1
c1fb01267a0994a40bae9b773e36f662a0ffd556

SHA256
73042a6624035274e6fd5ce4fbc01fe3419b769e854d29299caa566f5913def1

SHA512
1de6fd749c1b2f690390bc21ccff99f230db18925472d479aaa7ca23a222c40375e465bd19e05a70950e5982ef0a94e6c6e2d16f9f35f535ca31829b84fdfd80

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
156KB

MD5
7b2f715c1c3da8cfed84c2bff35676d9

SHA1
2b6d2a5b6110e6900b191123f940487040a770aa

SHA256
3a7fb45b49e026f5c517c5ea2dd99e40926e0fc9fd26b35053670461a52f3754

SHA512
683f776c7f821ccbd98f7ab117c19e6b174b46fd098f96465b6375013c1d6a0c495c958a38446c05c537835fbc6d2b96f255ddbfaf728175be4b50c480f9f52d

Download Submit
memory/1136-144-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1232-253-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1252-186-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1252-187-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1276-338-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1512-257-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1512-255-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1552-369-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1552-371-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1560-211-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1624-283-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1624-275-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1652-380-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1736-200-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1736-201-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1784-170-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1888-384-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/1888-385-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2384-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2384-138-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2392-140-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2392-136-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2392-145-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2392-141-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2392-139-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2780-158-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2780-156-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2780-155-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/2780-159-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3048-228-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3048-229-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3192-224-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3192-342-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3192-343-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3216-315-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3216-314-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3280-168-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3280-173-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3280-311-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3280-172-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3280-169-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3340-154-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3356-300-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3356-301-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3404-394-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3752-287-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3752-286-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/3776-267-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3776-262-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3972-325-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4204-215-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4204-214-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4208-368-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4220-271-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4220-272-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4264-355-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4264-357-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4444-352-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4476-242-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4476-243-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4516-197-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4524-412-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4524-413-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4580-182-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4596-399-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4596-398-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/4916-296-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4952-408-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5080-328-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/5080-329-0x0000000013140000-0x000000001315F000-memory.dmp

Filesize
124KB

Download
memory/5092-238-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads