xtremerat | b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

Analysis

max time kernel
214s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Size

43KB
MD5

8816f818b70bc4a8938d5811c94b3792
SHA1

b68ba20c493a94063c15f1107bd3ac7824871354
SHA256

b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f
SHA512

5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d
SSDEEP

768:4Br+tjFqTtTlJztWsvp8W3h/OXw1Z1j/fOTwYPIVzoQ/E:4yRUhlRZvp8W3PrjHuQFoQ/E

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 20 IoCs

resource	yara_rule
behavioral2/files/0x000b000000022dd6-133.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-134.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-137.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-140.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-143.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-146.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-149.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-152.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-155.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-158.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-161.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-164.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-167.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-170.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-173.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-176.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-179.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-182.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-185.dat	family_xtremerat
behavioral2/files/0x000b000000022dd6-188.dat	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 19 IoCs

pid	Process
3400	Server.exe
3544	Server.exe
1644	Server.exe
2164	Server.exe
1392	Server.exe
4356	Server.exe
736	Server.exe
3308	Server.exe
4368	Server.exe
1604	Server.exe
3760	Server.exe
4672	Server.exe
1400	Server.exe
260	Server.exe
3644	Server.exe
4364	Server.exe
4540	Server.exe
3400	Server.exe
3716	Server.exe

Modifies Installed Components in the registry 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Server.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
File created	C:\Windows\InstallDir\Server.exe	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3084	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	82
PID 2412 wrote to memory of 3084	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	82
PID 2412 wrote to memory of 3084	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	82
PID 2412 wrote to memory of 3956	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	83
PID 2412 wrote to memory of 3956	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	83
PID 2412 wrote to memory of 3956	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	83
PID 2412 wrote to memory of 1800	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	84
PID 2412 wrote to memory of 1800	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	84
PID 2412 wrote to memory of 1800	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	84
PID 2412 wrote to memory of 2508	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	85
PID 2412 wrote to memory of 2508	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	85
PID 2412 wrote to memory of 2508	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	85
PID 2412 wrote to memory of 3396	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	86
PID 2412 wrote to memory of 3396	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	86
PID 2412 wrote to memory of 3396	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	86
PID 2412 wrote to memory of 2096	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	87
PID 2412 wrote to memory of 2096	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	87
PID 2412 wrote to memory of 2096	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	87
PID 2412 wrote to memory of 2032	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	88
PID 2412 wrote to memory of 2032	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	88
PID 2412 wrote to memory of 2032	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	88
PID 2412 wrote to memory of 2228	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	89
PID 2412 wrote to memory of 2228	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	89
PID 2412 wrote to memory of 3400	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	91
PID 2412 wrote to memory of 3400	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	91
PID 2412 wrote to memory of 3400	2412	b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe	91
PID 3400 wrote to memory of 640	3400	Server.exe	92
PID 3400 wrote to memory of 640	3400	Server.exe	92
PID 3400 wrote to memory of 640	3400	Server.exe	92
PID 3400 wrote to memory of 1984	3400	Server.exe	93
PID 3400 wrote to memory of 1984	3400	Server.exe	93
PID 3400 wrote to memory of 1984	3400	Server.exe	93
PID 3400 wrote to memory of 2748	3400	Server.exe	94
PID 3400 wrote to memory of 2748	3400	Server.exe	94
PID 3400 wrote to memory of 2748	3400	Server.exe	94
PID 3400 wrote to memory of 3160	3400	Server.exe	95
PID 3400 wrote to memory of 3160	3400	Server.exe	95
PID 3400 wrote to memory of 3160	3400	Server.exe	95
PID 3400 wrote to memory of 3564	3400	Server.exe	96
PID 3400 wrote to memory of 3564	3400	Server.exe	96
PID 3400 wrote to memory of 3564	3400	Server.exe	96
PID 3400 wrote to memory of 3164	3400	Server.exe	97
PID 3400 wrote to memory of 3164	3400	Server.exe	97
PID 3400 wrote to memory of 3164	3400	Server.exe	97
PID 3400 wrote to memory of 3076	3400	Server.exe	98
PID 3400 wrote to memory of 3076	3400	Server.exe	98
PID 3400 wrote to memory of 3076	3400	Server.exe	98
PID 3400 wrote to memory of 2524	3400	Server.exe	99
PID 3400 wrote to memory of 2524	3400	Server.exe	99
PID 3400 wrote to memory of 3544	3400	Server.exe	100
PID 3400 wrote to memory of 3544	3400	Server.exe	100
PID 3400 wrote to memory of 3544	3400	Server.exe	100
PID 3544 wrote to memory of 4316	3544	Server.exe	101
PID 3544 wrote to memory of 4316	3544	Server.exe	101
PID 3544 wrote to memory of 4316	3544	Server.exe	101
PID 3544 wrote to memory of 1020	3544	Server.exe	102
PID 3544 wrote to memory of 1020	3544	Server.exe	102
PID 3544 wrote to memory of 1020	3544	Server.exe	102
PID 3544 wrote to memory of 4408	3544	Server.exe	103
PID 3544 wrote to memory of 4408	3544	Server.exe	103
PID 3544 wrote to memory of 4408	3544	Server.exe	103
PID 3544 wrote to memory of 1396	3544	Server.exe	104
PID 3544 wrote to memory of 1396	3544	Server.exe	104
PID 3544 wrote to memory of 1396	3544	Server.exe	104

C:\Users\Admin\AppData\Local\Temp\b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe
"C:\Users\Admin\AppData\Local\Temp\b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2228
- C:\Windows\InstallDir\Server.exe
  "C:\Windows\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2524
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4272
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Modifies Installed Components in the registry
      Checks computer location settings
      Adds Run key to start application
      PID:1644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:552
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:2164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3428
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3932
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2716
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4352
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1104
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3476
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1092
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:2540
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:968
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        14⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:3880
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4824
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        16⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:1460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:1720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:940
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:1592
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        18⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:1144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2264
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Checks computer location settings
        Adds Run key to start application
        
        PID:3400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:3820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:228
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        20⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
fea62eb98ccdeb294588708c774eb74a

SHA1
2497efc8da4dc7aab6a1c8cd6defd471731a5b99

SHA256
a3f9de322be034ac30cae3670573e280f6821f34fa61e286f880a6a66eb5dcc8

SHA512
56db6eeaac59803626d055687c8c4d2193a0d69f836e7b2df0d98e6b202a5714f4961b5057a25a73b25819d8c8849e2c3cd078d122d1389ebc8ad7834c4e8ce9

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
43KB

MD5
8816f818b70bc4a8938d5811c94b3792

SHA1
b68ba20c493a94063c15f1107bd3ac7824871354

SHA256
b0b6b51ce4a6c976fbea64f10fb51787e8c6e10fcf2bef0b5de0f628a5c7e83f

SHA512
5947da75f3ce09f67a064f530bf27f70daeffeb172d6d1048750b8a167f3fa46b3ab36883cc255cda89f5dd3e99d4a82d32fff9c471d95b59b3edc7a35a2b88d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads