d52b4189dccee476da84301edd9b57ed0120fe20d5cb694d927d547f6121c4c6

Analysis

max time kernel
72s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76c2a25d7c8bd45b19e22305d7ae2690.exe
Size

287KB
MD5

76c2a25d7c8bd45b19e22305d7ae2690
SHA1

01b2aef9ddf8094f3b5c7a6d540401ea99cc1e81
SHA256

d52b4189dccee476da84301edd9b57ed0120fe20d5cb694d927d547f6121c4c6
SHA512

5b3045e5efce0d3d348283a5de2274896be42420aae8d082782243aeb0b473ef919353ce2754b54950430860638ab63fcfa15b2ebd5b5bce79bb921c48e84fbf
SSDEEP

6144:IwirQk1KL3RKANb3dzKTAUsTxhA42bdzytt3lR+6dPrYcWiV5+KN9nIlg3:I1QaE3hNzKTWTXKb87VRry8kMmy3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2180	SServer.exe
620	SServer.exe
4532	SServer.exe
2636	SServer.exe
736	SServer.exe
4716	SServer.exe
2380	SServer.exe
4372	SServer.exe
5056	SServer.exe
2828	SServer.exe
2336	SServer.exe
2736	SServer.exe
2352	SServer.exe
5052	SServer.exe
4672	SServer.exe
1592	SServer.exe
1636	SServer.exe
3456	SServer.exe
4344	SServer.exe
4448	SServer.exe
4000	SServer.exe
1112	SServer.exe
468	SServer.exe
1768	SServer.exe
1688	SServer.exe
4604	SServer.exe
3644	SServer.exe
1620	SServer.exe
2748	SServer.exe
840	SServer.exe
4228	SServer.exe
3888	SServer.exe
816	SServer.exe
3472	SServer.exe
1684	SServer.exe
4516	SServer.exe
3620	SServer.exe
4148	SServer.exe
5116	SServer.exe
948	SServer.exe
3500	SServer.exe
3248	SServer.exe
5000	SServer.exe
4436	SServer.exe
624	SServer.exe
3068	SServer.exe
4500	SServer.exe
4624	SServer.exe
4892	SServer.exe
3052	SServer.exe
4560	SServer.exe
3744	SServer.exe
1624	SServer.exe
4668	SServer.exe
2880	SServer.exe
832	SServer.exe
3008	SServer.exe
2564	SServer.exe
1724	SServer.exe
2664	SServer.exe
3200	SServer.exe
1440	SServer.exe
820	SServer.exe
748	SServer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	Process not Found
File created	C:\Windows\SysWOW64\SServer.exe	Process not Found
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	Process not Found
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe
File created	C:\Windows\SysWOW64\SServer.exe	SServer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2180	5048	76c2a25d7c8bd45b19e22305d7ae2690.exe	589
PID 5048 wrote to memory of 2180	5048	76c2a25d7c8bd45b19e22305d7ae2690.exe	589
PID 5048 wrote to memory of 2180	5048	76c2a25d7c8bd45b19e22305d7ae2690.exe	589
PID 2180 wrote to memory of 620	2180	SServer.exe	18
PID 2180 wrote to memory of 620	2180	SServer.exe	18
PID 2180 wrote to memory of 620	2180	SServer.exe	18
PID 620 wrote to memory of 4532	620	SServer.exe	583
PID 620 wrote to memory of 4532	620	SServer.exe	583
PID 620 wrote to memory of 4532	620	SServer.exe	583
PID 4532 wrote to memory of 2636	4532	SServer.exe	19
PID 4532 wrote to memory of 2636	4532	SServer.exe	19
PID 4532 wrote to memory of 2636	4532	SServer.exe	19
PID 2636 wrote to memory of 736	2636	SServer.exe	20
PID 2636 wrote to memory of 736	2636	SServer.exe	20
PID 2636 wrote to memory of 736	2636	SServer.exe	20
PID 736 wrote to memory of 4716	736	SServer.exe	576
PID 736 wrote to memory of 4716	736	SServer.exe	576
PID 736 wrote to memory of 4716	736	SServer.exe	576
PID 4716 wrote to memory of 2380	4716	SServer.exe	569
PID 4716 wrote to memory of 2380	4716	SServer.exe	569
PID 4716 wrote to memory of 2380	4716	SServer.exe	569
PID 2380 wrote to memory of 4372	2380	SServer.exe	21
PID 2380 wrote to memory of 4372	2380	SServer.exe	21
PID 2380 wrote to memory of 4372	2380	SServer.exe	21
PID 4372 wrote to memory of 5056	4372	SServer.exe	558
PID 4372 wrote to memory of 5056	4372	SServer.exe	558
PID 4372 wrote to memory of 5056	4372	SServer.exe	558
PID 5056 wrote to memory of 2828	5056	SServer.exe	546
PID 5056 wrote to memory of 2828	5056	SServer.exe	546
PID 5056 wrote to memory of 2828	5056	SServer.exe	546
PID 2828 wrote to memory of 2336	2828	SServer.exe	542
PID 2828 wrote to memory of 2336	2828	SServer.exe	542
PID 2828 wrote to memory of 2336	2828	SServer.exe	542
PID 2336 wrote to memory of 2736	2336	SServer.exe	22
PID 2336 wrote to memory of 2736	2336	SServer.exe	22
PID 2336 wrote to memory of 2736	2336	SServer.exe	22
PID 2736 wrote to memory of 2352	2736	SServer.exe	23
PID 2736 wrote to memory of 2352	2736	SServer.exe	23
PID 2736 wrote to memory of 2352	2736	SServer.exe	23
PID 2352 wrote to memory of 5052	2352	SServer.exe	532
PID 2352 wrote to memory of 5052	2352	SServer.exe	532
PID 2352 wrote to memory of 5052	2352	SServer.exe	532
PID 5052 wrote to memory of 4672	5052	SServer.exe	526
PID 5052 wrote to memory of 4672	5052	SServer.exe	526
PID 5052 wrote to memory of 4672	5052	SServer.exe	526
PID 4672 wrote to memory of 1592	4672	SServer.exe	522
PID 4672 wrote to memory of 1592	4672	SServer.exe	522
PID 4672 wrote to memory of 1592	4672	SServer.exe	522
PID 1592 wrote to memory of 1636	1592	SServer.exe	511
PID 1592 wrote to memory of 1636	1592	SServer.exe	511
PID 1592 wrote to memory of 1636	1592	SServer.exe	511
PID 1636 wrote to memory of 3456	1636	SServer.exe	24
PID 1636 wrote to memory of 3456	1636	SServer.exe	24
PID 1636 wrote to memory of 3456	1636	SServer.exe	24
PID 3456 wrote to memory of 4344	3456	SServer.exe	25
PID 3456 wrote to memory of 4344	3456	SServer.exe	25
PID 3456 wrote to memory of 4344	3456	SServer.exe	25
PID 4344 wrote to memory of 4448	4344	SServer.exe	496
PID 4344 wrote to memory of 4448	4344	SServer.exe	496
PID 4344 wrote to memory of 4448	4344	SServer.exe	496
PID 4448 wrote to memory of 4000	4448	SServer.exe	489
PID 4448 wrote to memory of 4000	4448	SServer.exe	489
PID 4448 wrote to memory of 4000	4448	SServer.exe	489
PID 4000 wrote to memory of 1112	4000	SServer.exe	480

C:\Users\Admin\AppData\Local\Temp\76c2a25d7c8bd45b19e22305d7ae2690.exe
"C:\Users\Admin\AppData\Local\Temp\76c2a25d7c8bd45b19e22305d7ae2690.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2180

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4532

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4716

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5056

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5052

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4448

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:1768
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:1688

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4604
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:3644

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:2748
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:840
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    PID:4228

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3472
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    PID:4516

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4436
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:624

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3068
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:4500

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4560
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3744

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4668
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:2880

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:2564
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2664
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      Executes dropped EXE
      PID:3200

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:748
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:3604

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:2548
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:4336
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:4264

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:2260
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:2620
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:3912
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:1032
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:2448

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:3872
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:212
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:2744

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:3152
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:2728
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:3196
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5140
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:5196

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5228
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:5248
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:5272
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:5300
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        Drops file in System32 directory
        
        PID:5324

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5352
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:5384

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5420
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:5516
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:5560
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5628
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:5952

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5984
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:6012
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6032

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6052
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6100
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6128
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5136

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5188
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:5292
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:5440

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:4752
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:1172
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:5708
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:5752
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        Drops file in System32 directory
        
        PID:5864

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5892
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:5948
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Drops file in System32 directory
    PID:6060
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6124
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5184
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:5836

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6028
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:5428
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:412
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:2076
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5748
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:1640

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:4152
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6160

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6180
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6200
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6220
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6256
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6272
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:6340

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6356
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6392
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6416
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6440
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6464
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:6592

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6608
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:6632
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6660
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6684
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6716
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:6864

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Drops file in System32 directory
PID:6892
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6924
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6952
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6972
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6996
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:7140

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7164
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:6244
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6328
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6376
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6448
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:6532

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6588
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6676
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:2600
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      Drops file in System32 directory
      PID:6800
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:6884
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        Drops file in System32 directory
        
        PID:6944

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7032
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7096
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7156
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6292

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6424
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:6628
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Drops file in System32 directory
    PID:6792
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:6940
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:7132

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:6488
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7084
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:6920
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7180
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:7208
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:7344

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7372
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7400
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7424
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7452

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7468
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7488
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7516
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7544

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7568
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:7592
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7620
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7648

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7680
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7708
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7728
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7752
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:7780

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7800
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7836
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Drops file in System32 directory
    PID:7856

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7876
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:7912
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7944
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7976
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:8008
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:7200

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7340
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7496
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7688
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:7852
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:8180

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7336
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7740
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:7972

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7176
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:7588
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8168
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:7952
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:8200
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:8252

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8272
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8292
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8308
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8328

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8344
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:8364
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8384
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8400

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8416
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8432
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8452
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8472

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8488
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8504
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8524
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8544
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:8560

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8580
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8596
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8612
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      Drops file in System32 directory
      PID:8628
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:8644
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:8660

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8676
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8696
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8716
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8732

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8748
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8764

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8780
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:8804
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8840
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:8856
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:8872
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:9028

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9056
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9072
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9088
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9108
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9124
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:9144

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9160
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9180

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9196
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9212

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:8520
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9220
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9236
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9256
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9272

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9292
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:9308
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9324
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9340
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9360
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:9592

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9608
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9624
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9644
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9660

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9676
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9692
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9708
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9728
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9752
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:9768

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9784
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9800
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9820
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9836
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9852
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:9892

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:9912
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9928
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:9948
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9964
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9980
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:10084

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:10100
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:10116
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10132
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:10148
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:10164
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:10184

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Drops file in System32 directory
PID:10200
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:10216
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10232
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:9380
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:9420
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:3172

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:3908
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:9724
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    - Drops file in System32 directory
    PID:10252

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:10272
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:10292
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10308
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:10328
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:10348
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:10524

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:10544
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:10560
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10576
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:10592
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        Drops file in System32 directory
        
        PID:10608
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        Drops file in System32 directory
        
        PID:10628
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        20⤵
        
        PID:10884

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:10900
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:10916
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10936

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:10952
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:10972
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:10988
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:11008

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:11024
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:11044
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:11064

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:11080
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:11096
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:11112
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:11132
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:11148
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        Drops file in System32 directory
        
        PID:1476

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe c2e8a6089ab3e1bc76de537e13792ddd jEorVFgH40KzqxJ9KHRvgA.0.1.0.0.0
1⤵
PID:4116

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:820

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:832

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:1624
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:3016

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:1552
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:4680
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:11280
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:11296
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:11364

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:11384
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:11404
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:11420
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:11436
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:11452
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:11536

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:816

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:3888

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:11556
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:11572
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:11592
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      Drops file in System32 directory
      PID:11612
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        Drops file in System32 directory
        
        PID:11632
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:11872

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:11888
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:11904
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:11920
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:11940
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        Drops file in System32 directory
        
        PID:11956
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        Drops file in System32 directory
        
        PID:12008
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:12040

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:12056
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:12072
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12092
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:12108
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:12128
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:12200

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:12216
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:12232
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12252
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:12268
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:1856
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        Drops file in System32 directory
        
        PID:11276
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        Drops file in System32 directory
        
        PID:12296
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:12368

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:12388
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:12404
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12420

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:12436
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:12456
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12476
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:12496
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:12532
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:12744

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Drops file in System32 directory
PID:12764
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  - Drops file in System32 directory
  PID:12780
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12796
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:12812
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:12832
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        Drops file in System32 directory
        
        PID:12852
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        Drops file in System32 directory
        
        PID:12868
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        20⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        21⤵
        Drops file in System32 directory
        
        PID:13124
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        22⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        23⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        24⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        25⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        26⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        27⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        28⤵
        
        PID:13244

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:13260
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:13280
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:13296

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:12516
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:12552
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:12584
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:12624
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:12668
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:12716

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:13324
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:13340
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:13356
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:13376
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:13396
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:13552
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        Drops file in System32 directory
        
        PID:13632
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        20⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        21⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        22⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        23⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        24⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        25⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        26⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        27⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        28⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        29⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        30⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        31⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        32⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        33⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        34⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        35⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        36⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        37⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        38⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        39⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        40⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        41⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        42⤵
        
        PID:14076
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        43⤵
        
        PID:14092
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        44⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        45⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        46⤵
        
        PID:14144

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:14164
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:14184
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:14200
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:14216
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:14232
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:14376
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        
        PID:14408
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        
        PID:14424
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:14440
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        20⤵
        
        PID:14456
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        21⤵
        
        PID:14472
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        22⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        23⤵
        
        PID:14504
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        24⤵
        
        PID:14520
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        25⤵
        
        PID:14536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        26⤵
        
        PID:14552
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        27⤵
        
        PID:14572
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        28⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        29⤵
        
        PID:14612
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        30⤵
        
        PID:14632
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        31⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        32⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        33⤵
        
        PID:14684
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        34⤵
        
        PID:14700
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        35⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        36⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        37⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        38⤵
        
        PID:14772
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        39⤵
        
        PID:14788
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        40⤵
        
        PID:14808
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        41⤵
        
        PID:14824
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        42⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        43⤵
        
        PID:14860
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        44⤵
        
        PID:14880
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        45⤵
        
        PID:14896
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        46⤵
        
        PID:14912
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        47⤵
        
        PID:14928
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        48⤵
        
        PID:14944
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        49⤵
        
        PID:14960
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        50⤵
        
        PID:14976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        51⤵
        
        PID:14996
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        52⤵
        
        PID:15016
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        53⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        54⤵
        
        PID:15052
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        55⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        56⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        57⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        58⤵
        
        PID:15120
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        59⤵
        
        PID:15140
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        60⤵
        
        PID:15156
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        61⤵
        
        PID:15172
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        62⤵
        
        PID:15188
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        63⤵
        
        PID:15208
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        64⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        65⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        66⤵
        
        PID:15260
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        67⤵
        
        PID:15276
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        68⤵
        
        PID:15292
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        69⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        70⤵
        
        PID:15324
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        71⤵
        
        PID:15348
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        72⤵
        
        PID:14568
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        73⤵
        
        PID:15372
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        74⤵
        
        PID:15388
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        75⤵
        Drops file in System32 directory
        
        PID:15404
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        76⤵
        
        PID:15420
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        77⤵
        
        PID:15436
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        78⤵
        
        PID:15452
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        79⤵
        
        PID:15468
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        80⤵
        
        PID:15484
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        81⤵
        Drops file in System32 directory
        
        PID:15504
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        82⤵
        
        PID:15520
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        83⤵
        
        PID:15536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        84⤵
        
        PID:15584
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        85⤵
        
        PID:15620
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        86⤵
        
        PID:15640
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        87⤵
        
        PID:15656
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        88⤵
        
        PID:15672
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        89⤵
        
        PID:15688
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        90⤵
        
        PID:15704
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        91⤵
        
        PID:15744
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        92⤵
        
        PID:15788
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        93⤵
        
        PID:15844
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        94⤵
        
        PID:15976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        95⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        96⤵
        
        PID:16132
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        97⤵
        
        PID:16312
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        98⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        99⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        100⤵
        
        PID:4484

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:7580
- C:\Windows\SysWOW64\SServer.exe
  C:\Windows\system32\SServer.exe
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\SServer.exe
    C:\Windows\system32\SServer.exe
    3⤵
    PID:8048
  - - C:\Windows\SysWOW64\SServer.exe
      C:\Windows\system32\SServer.exe
      4⤵
      PID:5908
    - - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        5⤵
        
        PID:5924
      - C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        6⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        7⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        9⤵
        
        PID:16108
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        10⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        11⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        12⤵
        
        PID:16140
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        13⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        14⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        15⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        16⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        17⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        18⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        19⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        20⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        21⤵
        
        PID:16120
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        22⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        23⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        24⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        25⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        26⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        27⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        28⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        29⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        30⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        31⤵
        
        PID:16236
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        32⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        33⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        34⤵
        
        PID:16124
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        35⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        36⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        37⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        38⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        39⤵
        
        PID:16200
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        40⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        41⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        42⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        43⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        44⤵
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        45⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        46⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        47⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        48⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        49⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        50⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        51⤵
        
        PID:636
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        52⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        53⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        54⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        55⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        56⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        57⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        58⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        59⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        60⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        61⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        62⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        63⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        64⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        65⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        66⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        67⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        68⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        69⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        70⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        71⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        72⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        73⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        74⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        75⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        76⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        77⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        78⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        79⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        80⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        81⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        82⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        83⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        84⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        85⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        86⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        87⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        88⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        89⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        90⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        91⤵
        
        PID:552
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        92⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        93⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        94⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        95⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        96⤵
        Drops file in System32 directory
        
        PID:10484
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        97⤵
        Drops file in System32 directory
        
        PID:16372
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        98⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        99⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        100⤵
        
        PID:16280
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        101⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        102⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        103⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        104⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        105⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        106⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        107⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        108⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        109⤵
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        110⤵
        
        PID:16380
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        111⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        112⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        113⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        114⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        115⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        116⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        117⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        118⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        119⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        120⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        121⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        122⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        123⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        124⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        125⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        126⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        127⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        128⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        129⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        130⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        131⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        132⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        133⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        134⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        135⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        136⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        137⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        138⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        139⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        140⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        141⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        142⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        143⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        144⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        145⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        146⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        147⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        148⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        149⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        150⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        151⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        152⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        153⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        154⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        155⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        156⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        157⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        158⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        159⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        160⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        161⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        162⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        163⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        164⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        165⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        166⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        167⤵
        
        PID:15832
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        168⤵
        Drops file in System32 directory
        
        PID:8748
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        169⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        170⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        171⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        172⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        173⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        174⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        175⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        176⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        177⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        178⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        179⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        180⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        181⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        182⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        183⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        184⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        185⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        186⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        187⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        188⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        189⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        190⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        191⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        192⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        193⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        194⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        195⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        196⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        197⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        198⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        199⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        200⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        201⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        202⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        203⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        204⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        205⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        206⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        207⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        208⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        209⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        210⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        211⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        212⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        213⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        214⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        215⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        216⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        217⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        218⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        219⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        220⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        221⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        222⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        223⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        224⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        225⤵
        
        PID:15908
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        226⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        227⤵
        
        PID:15916
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        228⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        229⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        230⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        231⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        232⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        233⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        234⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        235⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        236⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        237⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        238⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        239⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        240⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        241⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        242⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        243⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        244⤵
        
        PID:15900
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        245⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        246⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        247⤵
        Drops file in System32 directory
        
        PID:10816
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        248⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        249⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        250⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        251⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        252⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        253⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        254⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        255⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        256⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        257⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        258⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        259⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        260⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        261⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        262⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        263⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        264⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        265⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        266⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        267⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        268⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        269⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        270⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        271⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        272⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        273⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        274⤵
        
        PID:13820
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        275⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        276⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        277⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        278⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        279⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        280⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        281⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        282⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        283⤵
        
        PID:548
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        284⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        285⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        286⤵
        
        PID:13936
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        287⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        288⤵
        
        PID:13988
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        289⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        290⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        291⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        292⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        293⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        294⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        295⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        296⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        297⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        298⤵
        
        PID:14152
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        299⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        300⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        301⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        302⤵
        
        PID:512
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        303⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        304⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        305⤵
        
        PID:15888
        
        C:\Windows\SysWOW64\SServer.exe
        
        C:\Windows\system32\SServer.exe
        306⤵
        
        PID:5388

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:5564

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:1624

C:\Windows\SysWOW64\SServer.exe
C:\Windows\system32\SServer.exe
1⤵
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SServer.exe

Filesize
37KB

MD5
e3b20d96f86ed3294b79d2cabcec7155

SHA1
61f84ed2aae0bb67e46bbf693cdda5e48d5b9397

SHA256
21670561007653443f49de159c67d1f7d6834bf403ef00195106c3aab74452a0

SHA512
9725550cb05d56511a6a1f70e836935efe99fa2ab08867c51cd8c8a9178416962a9adc0cde61ec369b56815b37ef4514ce1ac2e46fe0ec9b3cb4252e5d1fc8b6

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
5KB

MD5
67333abd9c9e5683584e5275adceeb30

SHA1
ade1921c5268a2bfd19790f244ddee49478952e3

SHA256
37b13fd77c3e5466a9a8b4fc3e1e025ee85865a06a6f694fb87146554ee5e50d

SHA512
8cb20606b38dae6866416f2cf44bb462501537632ac786d46ee84f0cb314f83be51330c976d513c2de135ef3300ba39d5c9e88184a259d12778afebd845f130a

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
22KB

MD5
f4bffea71f63329e4cd7293469ab19a6

SHA1
23bfba59189a149cd0e08d16053cfb5498b25bed

SHA256
f6691e07382f3f33819a788a5463af3e7f8cd5023fcfb27b15b3c48efccc0c64

SHA512
fdabae5ccb09eae057535d9a68142f9a299afe2d0e3a1f9e289f5768a1bcc9799755873f07dcd9b1b50f809a49dad97e2999b6519baacfea6b940f57f4b76930

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
45KB

MD5
d8cbb1fc581de8ace603997475a24ee4

SHA1
93df44a461344d1077cc4dfb088de4956810b776

SHA256
479d93fafdb562bedafb3a7f6135656cb78797221652923e5a5aeae339c61547

SHA512
1cbef0881ae405061ac87c7acdcbb87d8f7e7a5254bc793da3cedaecfb0599a36b8c1ad8231f5b498fe0233ed03ac0c1713b79ebd576f38837bd6ac4da3b801c

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
33KB

MD5
79635ffb7c4b8786768eed487ebb342e

SHA1
fbc902fcb3ef8be2a8ea7ca5b0479e2d990b311b

SHA256
1335829de35a6d5e09f0816e20ddbada911e3fd1eefaba35862c1ed579fc4ec7

SHA512
41f329456bc13b26564bbb18491abc6ef2b3af5449accb32e403acbc4aadbf7c733a6ab2b5694291f257415988b450ebea0a48d908dd412d0b9e76855435b91b

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
114KB

MD5
ff7282b085242f2c7c5bf9b0123ee04e

SHA1
9360ed4aa45cab4cc7fec20bf686a2b3a2e0f464

SHA256
fbfed68d6e6df8f84d0c2d2504dd836dedb49eb80d2b1bd8e155100f4ec97fc0

SHA512
8f698851b647ff648fc672164356ec6c0471e7b7c6b2de53ac62f806d6b40002018d690cb2f3e930a888ae119fab24328208aa265d8c163bf3d374b1fb11c1be

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
57KB

MD5
f967c1d72b0f89e978dd242d6dd13496

SHA1
7b767dfeb785a2e81009561008b8d16fd0c27938

SHA256
2cb88361a114aa020031118777a4c22a8580a739065130249ac865bf7bf3633a

SHA512
bb3c59b8707ae47712d6877686e87f2a9e04b3bca756a1adc004b6e454f3f8f713af53e1f382af6c0a159e84e8bf7070c9d50cbd3d86ed3d1005672e57fef3e6

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
34KB

MD5
97741e3071f40bf94cf44a3c147a4ba9

SHA1
9bdd02399b95f671dbe149eb4cec99c48c938437

SHA256
295b56749272214ebb6bb33c2b4d7b78f6954fb13e802089a44ed4c227f0253a

SHA512
c479108999ab9c49b94be0d7216c22a29173051c4ab5b22e7fb1cbd0920115b352cb8cfbd4179384449c148110e8b4651f4865f92e583dea4be3ecc9d7314c9a

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
92KB

MD5
5cbc4ebda40268343acef48686f138b4

SHA1
c80887aedc769e4af1dfe3777693cf0c58ef2d88

SHA256
fc225c63477481130a2f03541e8eed67957218b447f5c24b4d571e0666d00f56

SHA512
4e0c14dc5df10ac925d5c2aae5f809e21aa73bb711c5619d2075bbb71e3f5b3f39f4e7a76cd053d55ccd993afab2ffd041b92910f991c18d3dc214b78f18be27

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
110KB

MD5
76d20d02e615d721ba77e378265eadc0

SHA1
a319bf192457b1dc7e05bedab3d2f2e840aeea8e

SHA256
2300812104b33da073661b9adb07aafc374a5de289a9041f8ed80d25e493853b

SHA512
68c903d1aac40cd2fb96aad06f24ed3e2d02d6f164cbf58d27ec46ca7ed191842e061e384917049312888638fd66e6833f399ad8b91a459fa8f2968b235e65cf

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
90KB

MD5
c725760d0f1d13e04748d16c03bb593a

SHA1
104533f8dd2a68cde0e5a78a088e01115a5122af

SHA256
22acbb22caaea1cc822e9a56ccdad9d404ec73f0a0f3c80d6f89029e49309407

SHA512
e66239faaa949153e50e9914f05033c7be14b4d2cec417d9a76fc3c8d51290d3c44455e6d9a4d7a3f906a8e5def503199608b591bf00c6c83ef25850c6d78696

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
45KB

MD5
05afea3aa5000243a73e229bdd4031dc

SHA1
f3e3417b339622688eb7eadff81bac02d5042b78

SHA256
ce8c54d5b66ee99f0a2c3854d5f3c323f74906ec35f506807f4325de9f65059b

SHA512
10fc077af89b219614df050c9bcbc68bd84910b362540127213ea3bc3f4a3ad36dd7c81ff90007e83a7f6edaa14ba080e1e993d103d38e70e7ad636baaa4c378

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
51KB

MD5
3a6f78e0cf2f312b27023a58c7e12865

SHA1
05b95755a033ca08725806f5c9fa55a3e563ebd0

SHA256
52cd42da435cfc1758413055c7a5462f5d72250a0550f8a2d8d70a813b515716

SHA512
2149796bc45392a8043ba7c639a005df8661eee1cf83571a6520cb7b6a7f49287cf33c5c6ed151c9d1b66249ff14e0f5fe03b68a0d3e40f64c0d9d7f36088ceb

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
150KB

MD5
afb9e621327b9c61a4a09f56a62376a5

SHA1
31e0fb83bb8f2679cf55c0284dca17bbd7018f1f

SHA256
c79912d17a406139499ea7589fe29d45accd63ace562f5b0dd36127abb955fea

SHA512
b9112bad0e1b6b807fc4ee9bb81d9941d2b658ce4bbe7ac2eb6b70356940e1e4dd2dc41c025f89aef3db21ba3e8c10bb9e3fa5459eaae9763181f4b46626129d

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
59KB

MD5
831ede0d3dc25e63bceb2991cade7698

SHA1
67eabfb28ff4e86495f41f074ffee24fea079ebb

SHA256
f31698f84c174368d395629af30d67baf78073fec3344639e93660554d811db2

SHA512
0c09214795384abc0b4a651ab1f8c307ca44206bba8a57fa58839b0c115c272c009f6f7dd5fdad1ba28bdc82fcb95d1f9d1fee33673ee47c1b2de87d5a06871b

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
79KB

MD5
8b301ded579e035ee3ac7cb078a364d4

SHA1
caf09e424e84ba59be75c91907bd9c54e34d773a

SHA256
616b6a2f85682a91ad34ab7d837d2870ead6f4a7d2489377202b9b497564aa9a

SHA512
0152a9ef027d58fb814fea43512a470e7bd955851b055df8c7437b8d8b194fb7e5c62ea4195405f6eaf5fba52d31a9d631536b922b5b5ef0c0a2578fcea987a8

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
63KB

MD5
2821d55cbc3b19468f03adb0a575aeda

SHA1
a647553f740028bb4d53498bedd1c3ba8d2c1d6d

SHA256
75a665485cf9d05e1ab856fd082845cea1a2958870e5fafcbf9da12acfc13b79

SHA512
69b42bc9a788df4836fec769905b7799c64149d396e3665acc430b088ead6d58dc4d27c45728fef9beb64b4d48273624da46d734efd55214bf38d231726679e3

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
12KB

MD5
c2fb2508e992834c9e7ac0d01d3d76bb

SHA1
5dff6fe82432b0d37e8d7d19d2b4b2adcb2f9890

SHA256
c28c890ef7c4dd732f3c8f5bb858ae58107ec7f1e375f2eb196f99bbd46d620e

SHA512
9d93f0fd0a0c6db7e577fb11b9816baf41254a04c47a507120bcffef53115e11581bb3233c9151f710d9f5e97aa22e7ab45b01f54b7daa1634a3c52e898fcfe6

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
18KB

MD5
8d62c5a8bd7dfbee0a21b639cbcea007

SHA1
c8ffa5562ea8359cc8ebb14094c9b2ffd70bd0e2

SHA256
fb43b676e180d14d73915a79ab4d071ff6455f9a7a1e3199767d96f29285ff05

SHA512
9e8d1569824de870bdef6fc8ac596af61dce8c0ff03899b6e31b6d594b770bb7ec2f0aa9f0eff6bbe6f737753aaa2ef1c568534cadac0c4fc8035ed9e06ecb77

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
37KB

MD5
106de17a911ce677e1e559e51ce5c4b2

SHA1
24ee64c39ac7c65ddd0015b0446e8377c2ba5b38

SHA256
a300ccb188cb197020411e5b1a029e6ca3ead6efdcdeb5b8a25c4666c14d3fc8

SHA512
f7793518056b76c60e95530fe93acc2c59ee71a0202dffe2b75c3516a5e6e35700286e4f6eb7b2c55e3b111dfd4b5edfbf9384867a57cfe9f89ad78dcb2c69cd

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
33KB

MD5
058708ffb424c44b9dcc50193a1f5913

SHA1
d3f8a2821164a76aedcc6416a0d8e93abd880515

SHA256
466c68e1920356504ece4842ba953ec1c5ddcf320723fb3d14c8e339547c55c9

SHA512
30b15d9dedd7a125884031f3a2b48cd48292358b3d7fa2823c1ab2240ddd6d5a715862a28a4670ce20c6fc59674afb3b61d62d9ea2236d6b3d0f9923ac08412a

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
132KB

MD5
a07a83eb25db39b9400b63cb2f689e2a

SHA1
faf0b1e9e33e73b95ec53dbd05dc2f2570fde181

SHA256
4cf4a27789dd0d28fc1d081d7e0361f4fbc26f18c77ac43cf92ffc0107c78bee

SHA512
ebd37360fe47ae70be93fff5be9df08b12b3c359e89a729e98eced0b761f11021be67eb730fabea68cdb6496e17d95d4fb478238af818f3fe7f3fea194e4e2f0

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
287KB

MD5
76c2a25d7c8bd45b19e22305d7ae2690

SHA1
01b2aef9ddf8094f3b5c7a6d540401ea99cc1e81

SHA256
d52b4189dccee476da84301edd9b57ed0120fe20d5cb694d927d547f6121c4c6

SHA512
5b3045e5efce0d3d348283a5de2274896be42420aae8d082782243aeb0b473ef919353ce2754b54950430860638ab63fcfa15b2ebd5b5bce79bb921c48e84fbf

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
45KB

MD5
54c5c89215f3c5425a3496f0ef5f9804

SHA1
0ce2e4846e1eaa284b8427d033d1130ee791766d

SHA256
25b292280eeb95f4cc41d79379390b5631982c172976c73fb05b5ca163ef2c62

SHA512
d26470c7a3200089b2bd0cdf2731ff1612c891707d8f95b0a2e8b687b9fb35ea9b199bf6ebf81074850e2797c54df6138a99ad6dd932c92b6f49140f79852a5d

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
25KB

MD5
b7cd9573d6849db22d88c62756890471

SHA1
23157cfa571875f4e2922aeb9f941f233abaf433

SHA256
66b1ec38d426813c5adda1e2e61bb44b7bd0fe917d42fccbe8a91cf3c7de4874

SHA512
6e059e12dbefff1003ff10372bb525093700a3740374d4ae98224896f3d86f2733d5a716528b4e2ea613ff7a056b49578ef53ddfddb3891c466d1b97c3550542

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
66KB

MD5
640029286242b566233cc439fe62ad4a

SHA1
3409867f35d190b86029475bd2f23d9c3a77da04

SHA256
94a132649b59ae795339a67679ad1d4cf23ffa754d4bfdf1737c6acc2865bb74

SHA512
f044c202c1eb1d992b1ac5cc96ab4ca27ad517a17a7fa890e6f20abb6cc491b4e03f50a0bbc68868ab10d41d71c035db0d6fef4dcfcccfd2ac15d66d1b512e05

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
96KB

MD5
44c8a03d46b9d4cc44a0d13230a22e8e

SHA1
c4f270066cfa96f6437655f2cdc49146c893a89f

SHA256
57d4055cca99d33a909d835f47c6372df0e492cf98f35169251edb2cb2abccb6

SHA512
c17ba0e0244769dedf7b65e06e56aa8d65e1faaf012901af76f253f9e32531b4aff99f2616ef1f857195818d70e98996e82b50725f92d04d9b0459c81b820352

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
68KB

MD5
1c7da208b6ff0916f2986caec9d016d6

SHA1
29e87296829ae67819269875cb6c8e83e48fcc84

SHA256
8f15a19ee93effe431c4d2f61a273f09f1745c8a8bb4da76dde21e12e434365b

SHA512
89715c6bb4d548916761c261a4ea198e4c296291a0720b3840b21bd725e5c2d29ffc2a129220e57498a95d2c005c10c684d89e0e00ca942c9d81761ed8d8e5a1

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
9KB

MD5
0cb34dfafbc21832dc24c20060b7fa69

SHA1
084b1e6eb272b249f0f8ecbe86c7790f2994413a

SHA256
d7fc0145c94f55ebabdbe2c255b297585baa4056c8d56a9ba2fbfa53578dc203

SHA512
992c904232a7a4743c6623cbc3ccba9e6c67730723ff3c3325f0f33c2708c344a4fe55a3da524bc4a6fa54f062d37f15601621d93ccacdc2f665b0b74e948992

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
50KB

MD5
1fc2358f2686d069f24aa58609aedce5

SHA1
50c2cfae8dead69273b3cfd2d8cffa42ada36963

SHA256
be3f3abf95e25e79a20f33185a1c802ff3223a1b14d1ced9c38927d1de261ec2

SHA512
0d903d55bee63faf2d7f1dcfd577e5dd3537c6ef5ef796ab14dc36080399a1a3924a5a9a5d544aba34dd811fca6733f956f7c34ba68609a00370ca010fcc3cd8

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
49KB

MD5
dce3ca04240e5bc3b01896ebec37a60f

SHA1
3a2cfca6a3f602b070fe30695f24d44981cc7418

SHA256
c5375b10fa51cf1540ce9178ce6336a01fa0d19b15edba5900f9ea5ab395f2f6

SHA512
6dd19cdfea895a3d06b0e6d20b180a40ae191e5809b9bf98e03b755133ea9d5ac35585eed074c9f0f1034a07c36bdefe31eceb9a7afdf26969756dbf3fea6379

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
37KB

MD5
d5d23c179808f68de15a9b6186812c86

SHA1
a531e27a5cb84e7a083136ce32c74955bb488856

SHA256
28164ab1ee774410df868a2f6f013219fb94bc3b6a7a98813a58588d484147be

SHA512
d2cf247e51de018a17ac308d646694b94635fcf2b10ff836eaf9a52a0ecf63f445fef470fe91e8ffcb27b4928953505442200d39ebc3622d2fd8f5e164cb63ec

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
27KB

MD5
a98b1250bd1a4aa936af6801ffca081c

SHA1
0590e03f425b49a77e2bf307f89cc48e6ca0578d

SHA256
004fd0d9e37c994ed3b8db940bf350711f682f17ae111a601042494e5e034d67

SHA512
4f09ec6d4bbc0cd5d3fee74bc50e6b66c5ae42a4bd9615f4b1dfb17b5cb54e445627a790ddad1d149572606eea8c42b3223d987b29c39f66618b005937dbc095

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
18KB

MD5
a0905c135b93a4037d3d87844e3633bc

SHA1
7e897f021398ed624afdbfdcabc1cf656b44656c

SHA256
a704b2307e31230b05142d88b34cf0ae500ce7873edd1ed0cefcb54be4939e49

SHA512
e8243a2e5dc7b14678acd977f25bb63654cbc4257d0f76ebb6cc85d37d1586bf2b7c3b57aa845d35789d07664e6801890357e30bc544e7a5bcc3661ee4afe088

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
1KB

MD5
f92e88efac19ddf87540535cc2ddcb96

SHA1
1d03af9c716939f0fcca1ff17093bbaa9e8cba80

SHA256
4c9eadd0c2a998ad5c9a75ca826fdb529c336e074d46565200754733fb3f7c0c

SHA512
12d6d22185432473cc7dd1e43c81b7e019f60c6dc6cc73057d8ae28d3a713787421faa164ce1b198f2a5d77c02ee680905b85b9df96e87c53de4bc7c8ec89430

Download Submit
C:\Windows\SysWOW64\SServer.exe

Filesize
14KB

MD5
eb7d0d8daab603f930acdc35a6ed7d53

SHA1
743a7643e859312bac530b81d0b2995671615e1e

SHA256
ef13966f91e2864ea802fdeb4d67f91db8c0ff194f8f544edf7a24ed1b4947b1

SHA512
542615f45a458116950abf273ee0f1a363cfbe40346cbec104194b91797203b6ee9396f3d61f58aac0fa98fabf22466055a03ae4d09743cf4228ab7051643214

Download Submit
memory/468-83-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/620-21-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/620-8-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/736-15-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/736-33-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1112-79-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1112-77-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1592-74-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1592-59-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1592-57-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1636-61-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1636-81-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1688-89-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1768-84-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1768-88-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2180-6-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2180-17-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2336-40-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2336-56-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2336-38-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2352-63-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2352-46-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/2380-22-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2380-41-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2380-23-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2636-29-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2636-12-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2736-43-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/2736-42-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2736-58-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2828-34-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2828-53-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2828-35-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3456-64-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/3456-66-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/3644-94-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3644-93-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4000-78-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4000-75-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4344-70-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/4344-68-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4372-27-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4372-26-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4372-45-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4448-72-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/4532-25-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4532-10-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4604-90-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4604-92-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4672-71-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4672-52-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4672-54-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4716-37-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4716-19-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4716-18-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5048-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5048-14-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5048-1-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/5052-67-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5052-50-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/5052-49-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5056-30-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/5056-31-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/5056-48-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads