xtremerat | 1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

Analysis

max time kernel
154s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ede321ceaf563429f6738fd172937f43.exe
Size

42KB
MD5

ede321ceaf563429f6738fd172937f43
SHA1

c2ab1b887f6799a7ab4f74a71a6d83039f30c42c
SHA256

1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f
SHA512

6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180
SSDEEP

384:u3S1M6XizUkyeMdN/oNIjzqQ0YOPHXBJPcJqfeRBRXLJJtqsr4eGWG9ELJcSVjEc:u4egZtpjuTZsy8RXLbUKFqjC9PjzoI

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 64 IoCs

resource	yara_rule
behavioral2/memory/2540-3-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-4.dat	family_xtremerat
behavioral2/memory/3888-5-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-7.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-6.dat	family_xtremerat
behavioral2/memory/4268-12-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3888-13-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-14.dat	family_xtremerat
behavioral2/memory/928-15-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-16.dat	family_xtremerat
behavioral2/memory/5104-22-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-23.dat	family_xtremerat
behavioral2/memory/2528-24-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-25.dat	family_xtremerat
behavioral2/memory/4584-32-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-33.dat	family_xtremerat
behavioral2/memory/4384-34-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-35.dat	family_xtremerat
behavioral2/memory/1780-43-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-42.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-44.dat	family_xtremerat
behavioral2/memory/4636-45-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-52.dat	family_xtremerat
behavioral2/memory/3532-53-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-55.dat	family_xtremerat
behavioral2/memory/2736-54-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/648-62-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-63.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-64.dat	family_xtremerat
behavioral2/memory/4940-65-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2760-72-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-73.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-77.dat	family_xtremerat
behavioral2/memory/1608-78-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3608-83-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-82.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-84.dat	family_xtremerat
behavioral2/memory/2568-91-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/3020-92-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/1488-94-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-93.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-95.dat	family_xtremerat
behavioral2/memory/4828-103-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-102.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-104.dat	family_xtremerat
behavioral2/memory/2580-105-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/760-111-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-112.dat	family_xtremerat
behavioral2/memory/4752-113-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-117.dat	family_xtremerat
behavioral2/memory/2184-118-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-122.dat	family_xtremerat
behavioral2/memory/4888-123-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-127.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-131.dat	family_xtremerat
behavioral2/memory/4548-132-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-136.dat	family_xtremerat
behavioral2/memory/5108-137-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-138.dat	family_xtremerat
behavioral2/memory/5424-144-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-145.dat	family_xtremerat
behavioral2/memory/5296-146-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/files/0x0006000000022cf6-149.dat	family_xtremerat
behavioral2/files/0x0006000000022cf6-150.dat	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JMYUJQRK-428J-0G00-40O4-SWB108I7D7T2}	Server.exe

Checks computer location settings 2 TTPs 45 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.ede321ceaf563429f6738fd172937f43.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 63 IoCs

pid	Process
4268	Server.exe
928	Server.exe
2528	Server.exe
5104	Server.exe
4384	Server.exe
4584	Server.exe
1780	Server.exe
4636	Server.exe
3532	Server.exe
2736	Server.exe
648	Server.exe
4940	Server.exe
1608	Server.exe
2760	Server.exe
3608	Server.exe
3020	Server.exe
1488	Server.exe
2568	Server.exe
4828	Server.exe
2580	Server.exe
760	Server.exe
4752	Server.exe
2184	Server.exe
4888	Server.exe
4548	Server.exe
5108	Server.exe
5296	Server.exe
5396	Server.exe
5424	Server.exe
5612	Server.exe
5688	Server.exe
5700	Server.exe
5900	Server.exe
5972	Server.exe
5992	Server.exe
6136	Server.exe
2964	Server.exe
5192	Server.exe
860	Server.exe
5316	Server.exe
5908	Server.exe
5996	Server.exe
2288	Server.exe
6136	Server.exe
1796	Server.exe
2644	Server.exe
5988	Server.exe
5928	Server.exe
1092	Server.exe
1932	Server.exe
396	Server.exe
5332	Server.exe
856	Server.exe
824	Server.exe
1108	Server.exe
6044	Server.exe
6208	Server.exe
6256	Server.exe
6460	Server.exe
6476	Server.exe
6528	Server.exe
6744	Server.exe
6792	Server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\InstallDir\Server.exe	NEAS.ede321ceaf563429f6738fd172937f43.exe
File opened for modification	C:\Program Files (x86)\InstallDir\Server.exe	NEAS.ede321ceaf563429f6738fd172937f43.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2540	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	91
PID 3888 wrote to memory of 2540	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	91
PID 3888 wrote to memory of 2540	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	91
PID 3888 wrote to memory of 2540	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	91
PID 3888 wrote to memory of 1268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	92
PID 3888 wrote to memory of 1268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	92
PID 3888 wrote to memory of 1268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	92
PID 3888 wrote to memory of 1016	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	93
PID 3888 wrote to memory of 1016	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	93
PID 3888 wrote to memory of 1016	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	93
PID 3888 wrote to memory of 4020	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	94
PID 3888 wrote to memory of 4020	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	94
PID 3888 wrote to memory of 4020	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	94
PID 3888 wrote to memory of 1676	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	95
PID 3888 wrote to memory of 1676	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	95
PID 3888 wrote to memory of 1676	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	95
PID 3888 wrote to memory of 5012	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	96
PID 3888 wrote to memory of 5012	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	96
PID 3888 wrote to memory of 5012	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	96
PID 3888 wrote to memory of 4988	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	97
PID 3888 wrote to memory of 4988	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	97
PID 3888 wrote to memory of 4988	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	97
PID 3888 wrote to memory of 3484	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	98
PID 3888 wrote to memory of 3484	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	98
PID 3888 wrote to memory of 3484	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	98
PID 3888 wrote to memory of 1628	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	99
PID 3888 wrote to memory of 1628	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	99
PID 3888 wrote to memory of 4268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	100
PID 3888 wrote to memory of 4268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	100
PID 3888 wrote to memory of 4268	3888	NEAS.ede321ceaf563429f6738fd172937f43.exe	100
PID 2540 wrote to memory of 928	2540	svchost.exe	101
PID 2540 wrote to memory of 928	2540	svchost.exe	101
PID 2540 wrote to memory of 928	2540	svchost.exe	101
PID 928 wrote to memory of 4944	928	Server.exe	102
PID 928 wrote to memory of 4944	928	Server.exe	102
PID 928 wrote to memory of 4944	928	Server.exe	102
PID 928 wrote to memory of 3724	928	Server.exe	103
PID 928 wrote to memory of 3724	928	Server.exe	103
PID 928 wrote to memory of 3724	928	Server.exe	103
PID 928 wrote to memory of 2860	928	Server.exe	104
PID 928 wrote to memory of 2860	928	Server.exe	104
PID 928 wrote to memory of 2860	928	Server.exe	104
PID 928 wrote to memory of 500	928	Server.exe	107
PID 928 wrote to memory of 500	928	Server.exe	107
PID 928 wrote to memory of 500	928	Server.exe	107
PID 928 wrote to memory of 5084	928	Server.exe	108
PID 928 wrote to memory of 5084	928	Server.exe	108
PID 928 wrote to memory of 5084	928	Server.exe	108
PID 928 wrote to memory of 4892	928	Server.exe	110
PID 928 wrote to memory of 4892	928	Server.exe	110
PID 928 wrote to memory of 4892	928	Server.exe	110
PID 928 wrote to memory of 4220	928	Server.exe	112
PID 928 wrote to memory of 4220	928	Server.exe	112
PID 928 wrote to memory of 4220	928	Server.exe	112
PID 928 wrote to memory of 2080	928	Server.exe	113
PID 928 wrote to memory of 2080	928	Server.exe	113
PID 928 wrote to memory of 2528	928	Server.exe	114
PID 928 wrote to memory of 2528	928	Server.exe	114
PID 928 wrote to memory of 2528	928	Server.exe	114
PID 2540 wrote to memory of 5104	2540	svchost.exe	115
PID 2540 wrote to memory of 5104	2540	svchost.exe	115
PID 2540 wrote to memory of 5104	2540	svchost.exe	115
PID 2528 wrote to memory of 2792	2528	Server.exe	116
PID 2528 wrote to memory of 2792	2528	Server.exe	116

C:\Users\Admin\AppData\Local\Temp\NEAS.ede321ceaf563429f6738fd172937f43.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ede321ceaf563429f6738fd172937f43.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Modifies Installed Components in the registry
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2080
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3276
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:1780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1920
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:3532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4592
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:1928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3956
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:1608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:2464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1672
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:3020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4608
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:5104
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:4584
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2072
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1756
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4872
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        
        PID:2760
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:424
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      PID:1488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:400
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4868
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        
        PID:760
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:2568
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4760
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:2184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4752
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:4888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:4444
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5272
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5588
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5876
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:5900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5948
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5320
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      PID:5396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5932
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:6112
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:6136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5160
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5616
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4172
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        10⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:2288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:796
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:4008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:5148
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        12⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:5216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:5704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:5656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:4952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:5600
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:5204
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:5424
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:5688
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:5992
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5164
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      PID:860
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5760
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1152
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:6136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:5672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:1668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:408
      - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        6⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:2644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:5996
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        7⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:1092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2692
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        8⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:5332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:3060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:4000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        9⤵
        
        PID:5280
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        9⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:3896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:5900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:1468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:4076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        10⤵
        
        PID:6176
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:6412
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        11⤵
        Modifies Installed Components in the registry
        Checks computer location settings
        Executes dropped EXE
        
        PID:6460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        12⤵
        
        PID:6708
        
        C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        
        PID:6744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:6808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:6852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:6868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        13⤵
        
        PID:6884
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:5988
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:1932
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4980
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      PID:1108
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6200
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Checks computer location settings
      Executes dropped EXE
      PID:6256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6420
    - - C:\Program Files (x86)\InstallDir\Server.exe
        
        "C:\Program Files (x86)\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        
        PID:6476
- - C:\Program Files (x86)\InstallDir\Server.exe
    "C:\Program Files (x86)\InstallDir\Server.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6732
  - - C:\Program Files (x86)\InstallDir\Server.exe
      "C:\Program Files (x86)\InstallDir\Server.exe"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      PID:6792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:6892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1628
- C:\Program Files (x86)\InstallDir\Server.exe
  "C:\Program Files (x86)\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Program Files (x86)\InstallDir\Server.exe

Filesize
42KB

MD5
ede321ceaf563429f6738fd172937f43

SHA1
c2ab1b887f6799a7ab4f74a71a6d83039f30c42c

SHA256
1dc9d1b003e885b7f06ee33955fc56455df41c5bf8748aa0e76e8a0fc7b37c4f

SHA512
6e52fb09309d376cfb15fff16c3e2c7397cf2f07e1427a9d345c3bd356a2d933a16df7773589b6c30225af2b93396f50a29487fc3596f163f467bfa76813c180

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\iUFsTtEZ.cfg

Filesize
1KB

MD5
5663adac6bec645a811d9672c0a2f500

SHA1
88ca5ca29ec0f3c0fe870714774974bbf6e2b9d3

SHA256
c58a26bb24f1d170b01acde64e3f2861995a93eccdf89fabe59a60d84166e85e

SHA512
06f4291202481ad21001ae27d8b360009b7a2cffe265942df3e54dab717938168d8396ddde5c70f2ce89ee28c87f29c02082d3663fe4051d0f9e3b13a2d8d290

Download Submit
memory/396-221-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/648-62-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/760-111-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/824-231-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/856-223-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/860-180-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/928-15-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1092-216-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1108-228-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1488-94-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1608-78-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1780-43-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1796-204-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1932-212-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2184-118-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2288-195-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2528-24-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2540-3-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2568-91-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2580-105-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2644-207-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2736-54-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2760-72-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2964-175-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3020-92-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3532-53-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3608-83-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3888-5-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/3888-13-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4268-12-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4384-34-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4548-132-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4584-32-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4636-45-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4752-113-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4828-103-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4888-123-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/4940-65-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5104-22-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5108-137-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5192-183-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5296-146-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5316-186-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5332-222-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5396-151-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5424-144-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5612-159-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5688-157-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5700-162-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5900-165-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5908-189-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5928-213-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5972-169-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5988-203-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5992-168-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5996-192-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6044-234-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6136-198-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6136-174-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6208-237-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6256-238-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6460-246-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6476-243-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/6528-249-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads