xtremerat | 1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
159s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Size

290KB
MD5

7ee1ec661c83f963eedc619390d1cf0d
SHA1

088400864842aa89878b59b6520ac6dc489b01a1
SHA256

0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a
SHA512

02ea27b45edb24e5a5ef4ff7003648c76f305d155a4fc7761a8c761c5437d7cf9d132f017b20fea2f9c2ef28b1dd0cd10d8400f0be90d6e55b0920d3c909c500
SSDEEP

6144://0uoAgR+cX0ijt+/wLZ+mlRY5Fas7qcJ:/Jdu+cXbt+/wV/YTuC

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

sexsevngmail.zapto.org

Signatures

Detect XtremeRAT payload 48 IoCs

resource	yara_rule
behavioral3/memory/5012-14-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2796-47-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/440-53-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/5088-56-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/116-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4056-65-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4340-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1656-73-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4548-76-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3344-80-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2984-83-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4516-87-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4596-90-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/960-94-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3384-97-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3620-101-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4868-104-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2968-108-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1736-111-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1300-115-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4680-118-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4128-122-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3984-125-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1656-130-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4536-134-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/516-137-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4952-141-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1932-144-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4320-149-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3576-153-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1060-156-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4520-160-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1136-163-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4092-167-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2852-170-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/3788-174-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4144-178-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/5112-182-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/664-185-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/2100-189-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4708-192-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4144-195-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/224-197-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4424-200-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4212-203-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4144-207-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/1080-210-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral3/memory/4752-214-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

Checks computer location settings 2 TTPs 25 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 26 IoCs

pid	Process
2796	server.exe
5088	Server.exe
116	Server.exe
4340	Server.exe
4548	Server.exe
2984	Server.exe
4596	Server.exe
3384	Server.exe
4868	Server.exe
1736	Server.exe
4680	Server.exe
3984	Server.exe
1656	Server.exe
516	Server.exe
1932	Server.exe
4320	Server.exe
1060	Server.exe
1136	Server.exe
2852	Server.exe
4144	Server.exe
664	Server.exe
4708	Server.exe
224	Server.exe
4212	Server.exe
1080	Server.exe
3980	Server.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2796-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0007000000022e69-5.dat	upx
behavioral3/files/0x0007000000022e69-7.dat	upx
behavioral3/files/0x0006000000022e70-11.dat	upx
behavioral3/memory/5012-14-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-45.dat	upx
behavioral3/files/0x0006000000022e70-46.dat	upx
behavioral3/memory/2796-47-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/440-53-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/5088-56-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-55.dat	upx
behavioral3/files/0x0006000000022e70-60.dat	upx
behavioral3/memory/116-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4056-65-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-68.dat	upx
behavioral3/memory/4340-69-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1656-73-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-75.dat	upx
behavioral3/memory/4548-76-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/3344-80-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-82.dat	upx
behavioral3/memory/2984-83-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4516-87-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-89.dat	upx
behavioral3/memory/4596-90-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/960-94-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-96.dat	upx
behavioral3/memory/3384-97-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/3620-101-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-103.dat	upx
behavioral3/memory/4868-104-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/2968-108-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-110.dat	upx
behavioral3/memory/1736-111-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1300-115-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4680-118-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-117.dat	upx
behavioral3/memory/4128-122-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-124.dat	upx
behavioral3/memory/3984-125-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/1656-130-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-129.dat	upx
behavioral3/memory/4536-134-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-136.dat	upx
behavioral3/memory/516-137-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4952-141-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-143.dat	upx
behavioral3/memory/1932-144-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-148.dat	upx
behavioral3/memory/4320-149-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/3576-153-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-155.dat	upx
behavioral3/memory/1060-156-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4520-160-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-162.dat	upx
behavioral3/memory/1136-163-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/4092-167-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-169.dat	upx
behavioral3/memory/2852-170-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/3788-174-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-177.dat	upx
behavioral3/memory/4144-178-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/memory/5112-182-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral3/files/0x0006000000022e70-184.dat	upx

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in Windows directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File created	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2796	2464	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	89
PID 2464 wrote to memory of 2796	2464	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	89
PID 2464 wrote to memory of 2796	2464	0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe	89
PID 2796 wrote to memory of 5012	2796	server.exe	90
PID 2796 wrote to memory of 5012	2796	server.exe	90
PID 2796 wrote to memory of 5012	2796	server.exe	90
PID 2796 wrote to memory of 5012	2796	server.exe	90
PID 2796 wrote to memory of 4324	2796	server.exe	91
PID 2796 wrote to memory of 4324	2796	server.exe	91
PID 2796 wrote to memory of 4324	2796	server.exe	91
PID 2796 wrote to memory of 1296	2796	server.exe	93
PID 2796 wrote to memory of 1296	2796	server.exe	93
PID 2796 wrote to memory of 1296	2796	server.exe	93
PID 2796 wrote to memory of 400	2796	server.exe	95
PID 2796 wrote to memory of 400	2796	server.exe	95
PID 2796 wrote to memory of 400	2796	server.exe	95
PID 2796 wrote to memory of 3616	2796	server.exe	98
PID 2796 wrote to memory of 3616	2796	server.exe	98
PID 2796 wrote to memory of 3616	2796	server.exe	98
PID 2796 wrote to memory of 3160	2796	server.exe	99
PID 2796 wrote to memory of 3160	2796	server.exe	99
PID 2796 wrote to memory of 3160	2796	server.exe	99
PID 2796 wrote to memory of 4148	2796	server.exe	102
PID 2796 wrote to memory of 4148	2796	server.exe	102
PID 2796 wrote to memory of 4148	2796	server.exe	102
PID 2796 wrote to memory of 4972	2796	server.exe	103
PID 2796 wrote to memory of 4972	2796	server.exe	103
PID 2796 wrote to memory of 4972	2796	server.exe	103
PID 2796 wrote to memory of 60	2796	server.exe	104
PID 2796 wrote to memory of 60	2796	server.exe	104
PID 2796 wrote to memory of 5088	2796	server.exe	106
PID 2796 wrote to memory of 5088	2796	server.exe	106
PID 2796 wrote to memory of 5088	2796	server.exe	106
PID 5088 wrote to memory of 440	5088	Server.exe	107
PID 5088 wrote to memory of 440	5088	Server.exe	107
PID 5088 wrote to memory of 440	5088	Server.exe	107
PID 5088 wrote to memory of 440	5088	Server.exe	107
PID 5088 wrote to memory of 1668	5088	Server.exe	108
PID 5088 wrote to memory of 1668	5088	Server.exe	108
PID 5088 wrote to memory of 1668	5088	Server.exe	108
PID 5088 wrote to memory of 4700	5088	Server.exe	109
PID 5088 wrote to memory of 4700	5088	Server.exe	109
PID 5088 wrote to memory of 4700	5088	Server.exe	109
PID 5088 wrote to memory of 4160	5088	Server.exe	110
PID 5088 wrote to memory of 4160	5088	Server.exe	110
PID 5088 wrote to memory of 4160	5088	Server.exe	110
PID 5088 wrote to memory of 4164	5088	Server.exe	111
PID 5088 wrote to memory of 4164	5088	Server.exe	111
PID 5088 wrote to memory of 4164	5088	Server.exe	111
PID 5088 wrote to memory of 4208	5088	Server.exe	112
PID 5088 wrote to memory of 4208	5088	Server.exe	112
PID 5088 wrote to memory of 4208	5088	Server.exe	112
PID 5088 wrote to memory of 2896	5088	Server.exe	114
PID 5088 wrote to memory of 2896	5088	Server.exe	114
PID 5088 wrote to memory of 2896	5088	Server.exe	114
PID 5088 wrote to memory of 4416	5088	Server.exe	115
PID 5088 wrote to memory of 4416	5088	Server.exe	115
PID 5088 wrote to memory of 4416	5088	Server.exe	115
PID 5088 wrote to memory of 1984	5088	Server.exe	116
PID 5088 wrote to memory of 1984	5088	Server.exe	116
PID 5088 wrote to memory of 116	5088	Server.exe	117
PID 5088 wrote to memory of 116	5088	Server.exe	117
PID 5088 wrote to memory of 116	5088	Server.exe	117
PID 116 wrote to memory of 4932	116	Server.exe	118

C:\Users\Admin\AppData\Local\Temp\0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
"C:\Users\Admin\AppData\Local\Temp\0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:60
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1984
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3320
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4340
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2240
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3748
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        8⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3716
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        9⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:2272
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        10⤵
        
        PID:960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3380
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        11⤵
        
        PID:3620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4732
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        12⤵
        
        PID:2968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3872
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        13⤵
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:1512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:3456
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        14⤵
        
        PID:4128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:2280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3252
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        14⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        15⤵
        
        PID:368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:2608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        15⤵
        
        PID:1792
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:516
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        16⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:4224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:1004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:5080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        16⤵
        
        PID:2776
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        16⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        17⤵
        
        PID:4952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:4376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:3060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        17⤵
        
        PID:2288
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        18⤵
        
        PID:2160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:1072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:2464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:1608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        18⤵
        
        PID:4176
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        18⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        19⤵
        
        PID:3576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:4288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:2904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:3640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        19⤵
        
        PID:1156
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        20⤵
        
        PID:4520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:4088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:1932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:3824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        20⤵
        
        PID:2920
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        20⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        21⤵
        
        PID:4092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:3056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        21⤵
        
        PID:5000
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        21⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        22⤵
        
        PID:3788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:2372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:1520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:4520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:4644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        22⤵
        
        PID:1304
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        22⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        23⤵
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:2852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:2796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        23⤵
        
        PID:3868
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        23⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        24⤵
        
        PID:2100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:1328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:2416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:2300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        24⤵
        
        PID:2444
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        24⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        25⤵
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:2404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        25⤵
        
        PID:4920
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        25⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        26⤵
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:4888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:2100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:3468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:1256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        26⤵
        
        PID:2192
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        26⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        27⤵
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:3556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:2324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:5068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        27⤵
        
        PID:4880
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        27⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3980
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        28⤵
        
        PID:4752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        28⤵
        
        PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
84f0418a5382a8bf34c259101aa073a5

SHA1
57a561baf71cee80b0e45e4f3f0db82f7f4e2092

SHA256
a318b4f74808bd9b01e9e20dd30b31c6c0e0f33482c364a87fa8ad02aa7f9132

SHA512
a73504de88c107d7651b29caf1e17642c312d2d8e1ccb6f98720bd561514278d28519bd39097dbaded7037de5ee2b5bc81caa20fc35784f4da528c241eca6360

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
21KB

MD5
16dadac78c0ab2fe9bd017d29df66289

SHA1
e702f4ec702e6c3e3217c2261a14a6d54cee225f

SHA256
c2db3f1fde12c88e386b2199f773c618250a9458240de5ed49ac7404ef015bed

SHA512
4b7ca69245ed1bbc0f2776f85c910d85d8ceacbcb67a9c1136ba63cd3d3813111a47f35d7cc95c1ec5effa47afc16198314754855d8b149099134156c1e2facc

Download Submit
memory/116-61-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/224-197-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/440-53-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/516-137-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/664-185-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/960-94-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1060-156-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1080-210-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1136-163-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1300-115-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1656-73-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1656-130-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1736-111-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1932-144-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2100-189-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-47-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2796-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2852-170-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2968-108-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2984-83-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3344-80-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3384-97-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3576-153-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3620-101-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3788-174-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3984-125-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4056-65-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4092-167-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4128-122-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4144-207-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4144-195-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4144-178-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4212-203-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4320-149-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4340-69-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4424-200-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4516-87-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4520-160-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4536-134-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4548-76-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4596-90-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4680-118-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4708-192-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4752-214-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4868-104-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/4952-141-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5012-14-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5088-56-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/5112-182-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads