Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1440 wrote to memory of 4952	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1440 wrote to memory of 4952	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1440 wrote to memory of 4952	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1440 wrote to memory of 3172	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1440 wrote to memory of 3172	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3172 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3172 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3172 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3172 wrote to memory of 2208	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3172 wrote to memory of 2208	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2208 wrote to memory of 5240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2208 wrote to memory of 5240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2208 wrote to memory of 5240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2208 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2208 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2628 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2628 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2628 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2628 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2628 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 5000 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5000 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5000 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5000 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 5000 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4784 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4784 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4784 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4784 wrote to memory of 1616	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4784 wrote to memory of 1616	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1616 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1616 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1616 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1616 wrote to memory of 4548	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1616 wrote to memory of 4548	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4548 wrote to memory of 5088	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4548 wrote to memory of 5088	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4548 wrote to memory of 5088	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4548 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4548 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2084 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2084 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2084 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2084 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2084 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 316 wrote to memory of 5944	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 316 wrote to memory of 5944	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 316 wrote to memory of 5944	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 316 wrote to memory of 4564	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 316 wrote to memory of 4564	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4564 wrote to memory of 3248	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4564 wrote to memory of 3248	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4564 wrote to memory of 3248	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4564 wrote to memory of 1364	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4564 wrote to memory of 1364	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1364 wrote to memory of 4340	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1364 wrote to memory of 4340	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1364 wrote to memory of 4340	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1364 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1364 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4872 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4872 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4872 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4872 wrote to memory of 1760	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	206.221.208.4.in-addr.arpa	udp
US	8.8.8.8:53	132.250.30.184.in-addr.arpa	udp
US	8.8.8.8:53	month-washer.gl.at.ply.gg	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	19.221.185.147.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	api.ip.sb	udp
US	104.26.12.31:443	api.ip.sb	tcp
US	8.8.8.8:53	31.12.26.104.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	17.14.97.104.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	51.15.97.104.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.12.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp

Files

memory/1440-0-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/1440-1-0x00000000001E0000-0x0000000001372000-memory.dmp

memory/1440-3-0x000000001C160000-0x000000001C170000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5	5bf06998216b64bdde7e0356fff186e6
SHA1	2bfc86b0718eff41d4976212547fc651c75a5814
SHA256	b5f4a205a5c19245cfc9ea9a0e443d394b76f94af19f69144a084a5252c0da50
SHA512	1355ec92bf7eedba5b3785fb2ecc83aa91fb4beebdecca863c40f1e64925af9ee6281b78137ec891a278da808dbe4f3eca0828d6aece17f25cf061ab108e741c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\slinkyloader.exe.log

MD5	2ff39f6c7249774be85fd60a8f9a245e
SHA1	684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256	e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512	1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/4952-16-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/4952-17-0x0000000000DC0000-0x0000000000DDE000-memory.dmp

memory/1440-18-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4952-20-0x0000000005E30000-0x0000000006448000-memory.dmp

memory/3172-19-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4952-21-0x0000000005780000-0x0000000005792000-memory.dmp

memory/4952-22-0x0000000005810000-0x000000000584C000-memory.dmp

memory/4952-23-0x0000000005800000-0x0000000005810000-memory.dmp

memory/4952-24-0x00000000057A0000-0x00000000057EC000-memory.dmp

memory/4952-25-0x0000000005A90000-0x0000000005B9A000-memory.dmp

memory/3172-26-0x000000001C940000-0x000000001C950000-memory.dmp

memory/3540-28-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/3540-29-0x0000000005830000-0x0000000005840000-memory.dmp

memory/3172-30-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/2208-31-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/2208-32-0x000000001C490000-0x000000001C4A0000-memory.dmp

memory/5240-34-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/5240-35-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/2208-36-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4952-37-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/2628-38-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/2628-39-0x0000000003C30000-0x0000000003C40000-memory.dmp

memory/2628-42-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4952-41-0x0000000005800000-0x0000000005810000-memory.dmp

memory/5000-43-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/760-44-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/760-46-0x0000000004EF0000-0x0000000004F00000-memory.dmp

memory/3540-45-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/3540-47-0x0000000005830000-0x0000000005840000-memory.dmp

memory/2784-49-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/5240-50-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/5000-51-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4784-52-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/2784-53-0x0000000005700000-0x0000000005710000-memory.dmp

memory/5240-54-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/4036-56-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/4784-57-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4036-58-0x0000000004980000-0x0000000004990000-memory.dmp

memory/3540-59-0x0000000006DB0000-0x0000000006F72000-memory.dmp

memory/3540-60-0x00000000074B0000-0x00000000079DC000-memory.dmp

memory/1616-61-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/3540-62-0x0000000006D40000-0x0000000006DA6000-memory.dmp

memory/3540-63-0x0000000007140000-0x00000000071B6000-memory.dmp

memory/3540-64-0x00000000072B0000-0x0000000007342000-memory.dmp

memory/3540-65-0x0000000007F90000-0x0000000008534000-memory.dmp

memory/3540-66-0x0000000007290000-0x00000000072AE000-memory.dmp

memory/760-82-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/1616-83-0x000000001C0E0000-0x000000001C0F0000-memory.dmp

memory/1616-101-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp80F4.tmp

MD5	6d242e9151b8b7460c58d840c0c90ac6
SHA1	1f75ebb9f99c53bcb9c5060d92e8a82930299216
SHA256	1fbfa53be1ed175adae59b6d0342c634fc132205ae2d7c449836db65dabebbcd
SHA512	071c41f9d928936a635389b0557ef4e94dc639b53586268f78388ec4b8f3cf72f4a569989819d44639ab54129938e4ffd906c42a55235860f583907cda714e10

C:\Users\Admin\AppData\Local\Temp\tmp80DE.tmp

MD5	8f5942354d3809f865f9767eddf51314
SHA1	20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256	776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512	fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

memory/760-100-0x0000000004EF0000-0x0000000004F00000-memory.dmp

memory/4548-130-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/2168-131-0x0000000074D30000-0x00000000754E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8221.tmp

MD5	d367ddfda80fdcf578726bc3b0bc3e3c
SHA1	23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256	0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512	40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\tmp8206.tmp

MD5	f70aa3fa04f0536280f872ad17973c3d
SHA1	50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256	8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512	30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/2168-259-0x0000000004D10000-0x0000000004D20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8200.tmp

MD5	49693267e0adbcd119f9f5e02adf3a80
SHA1	3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256	d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512	b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

memory/2784-188-0x0000000074D30000-0x00000000754E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp81EA.tmp

MD5	349e6eb110e34a08924d92f6b334801d
SHA1	bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256	c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512	2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp881D.tmp

MD5	87cbab2a743fb7e0625cc332c9aac537
SHA1	50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256	57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512	6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

C:\Users\Admin\AppData\Local\Temp\tmp881C.tmp

MD5	3b068f508d40eb8258ff0b0592ca1f9c
SHA1	59ac025c3256e9c6c86165082974fe791ff9833a
SHA256	07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512	e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\tmp881B.tmp

MD5	bfbc1a403197ac8cfc95638c2da2cf0e
SHA1	634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256	272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512	b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\tmp881A.tmp

MD5	4a8fbd593a733fc669169d614021185b
SHA1	166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256	714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512	6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\tmp8819.tmp

MD5	a33e5b189842c5867f46566bdbf7a095
SHA1	e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256	5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512	f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

memory/4548-921-0x00000000027B0000-0x00000000027C0000-memory.dmp

memory/5088-923-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/2084-925-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/4548-924-0x00007FF9DD850000-0x00007FF9DE311000-memory.dmp

memory/5088-926-0x0000000005200000-0x0000000005210000-memory.dmp

memory/4036-927-0x0000000074D30000-0x00000000754E0000-memory.dmp

memory/2084-928-0x00000000026F0000-0x0000000002700000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log

MD5	c0ced3fd9b42a0142448d507f6a4c2af
SHA1	cb66ee9d9920cc61bb982709c15e448bc45de0a9
SHA256	1af3fb7e6be9a8ddfaddc28f4f2d4cf99f1fa06d57747ec1d8b1442bb2785037
SHA512	1a655235898051f13a58d417b284c51746f5acbe6fd5e7de74d537bfdf14b44e978e6581b8872c0d790d8048ad8836ea8b8be805fb993e2852301620dad92100

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 15:56

Reported

2024-04-21 16:01

Platform

win11-20240412-en

Max time kernel

299s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\Server.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4944 wrote to memory of 456	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4944 wrote to memory of 456	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4944 wrote to memory of 456	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4944 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4944 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4928 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4928 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4928 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4928 wrote to memory of 868	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4928 wrote to memory of 868	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 868 wrote to memory of 3892	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 868 wrote to memory of 3892	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 868 wrote to memory of 3892	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 868 wrote to memory of 5020	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 868 wrote to memory of 5020	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 5020 wrote to memory of 236	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5020 wrote to memory of 236	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5020 wrote to memory of 236	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5020 wrote to memory of 2204	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 5020 wrote to memory of 2204	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2204 wrote to memory of 556	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2204 wrote to memory of 556	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2204 wrote to memory of 556	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2204 wrote to memory of 4100	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2204 wrote to memory of 4100	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4100 wrote to memory of 240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4100 wrote to memory of 240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4100 wrote to memory of 240	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4100 wrote to memory of 3480	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4100 wrote to memory of 3480	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3480 wrote to memory of 3336	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3480 wrote to memory of 3336	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3480 wrote to memory of 3336	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3480 wrote to memory of 3132	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3480 wrote to memory of 3132	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3132 wrote to memory of 720	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3132 wrote to memory of 720	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3132 wrote to memory of 720	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3132 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 3132 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1060 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1060 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1060 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1060 wrote to memory of 4148	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 1060 wrote to memory of 4148	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4148 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4148 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4148 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4148 wrote to memory of 2192	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4148 wrote to memory of 2192	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2192 wrote to memory of 1548	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2192 wrote to memory of 1548	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2192 wrote to memory of 1548	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2192 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 2192 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4088 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4088 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4088 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 4088 wrote to memory of 5036	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 4088 wrote to memory of 5036	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
PID 5036 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5036 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5036 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 5036 wrote to memory of 3132	N/A	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe	C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe

"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	month-washer.gl.at.ply.gg	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	19.221.185.147.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
NL	52.111.243.29:443		tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	104.26.13.31:443	api.ip.sb	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp
US	147.185.221.19:33498	month-washer.gl.at.ply.gg	tcp

Files

memory/4944-0-0x0000000000380000-0x0000000001512000-memory.dmp

memory/4944-1-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/4944-3-0x000000001C2E0000-0x000000001C2F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5	5bf06998216b64bdde7e0356fff186e6
SHA1	2bfc86b0718eff41d4976212547fc651c75a5814
SHA256	b5f4a205a5c19245cfc9ea9a0e443d394b76f94af19f69144a084a5252c0da50
SHA512	1355ec92bf7eedba5b3785fb2ecc83aa91fb4beebdecca863c40f1e64925af9ee6281b78137ec891a278da808dbe4f3eca0828d6aece17f25cf061ab108e741c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\slinkyloader.exe.log

MD5	2cbbb74b7da1f720b48ed31085cbd5b8
SHA1	79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256	e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512	ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

memory/4944-16-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/4928-18-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/456-17-0x0000000000C20000-0x0000000000C3E000-memory.dmp

memory/456-19-0x0000000005D00000-0x0000000006318000-memory.dmp

memory/456-20-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/456-21-0x00000000056A0000-0x00000000056B2000-memory.dmp

memory/456-22-0x0000000005720000-0x000000000575C000-memory.dmp

memory/456-23-0x00000000056D0000-0x00000000056E0000-memory.dmp

memory/456-24-0x0000000005760000-0x00000000057AC000-memory.dmp

memory/456-25-0x00000000059B0000-0x0000000005ABA000-memory.dmp

memory/4928-26-0x000000001C750000-0x000000001C760000-memory.dmp

memory/4928-29-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/2180-28-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/868-30-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/2180-31-0x00000000032E0000-0x00000000032F0000-memory.dmp

memory/868-32-0x000000001CBE0000-0x000000001CBF0000-memory.dmp

memory/3892-34-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/868-35-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/3892-36-0x00000000057B0000-0x00000000057C0000-memory.dmp

memory/5020-37-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/456-38-0x0000000006CF0000-0x0000000006EB2000-memory.dmp

memory/456-39-0x00000000073F0000-0x000000000791C000-memory.dmp

memory/456-40-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/5020-41-0x0000000003430000-0x0000000003440000-memory.dmp

memory/456-43-0x0000000007ED0000-0x0000000008476000-memory.dmp

memory/456-44-0x0000000006EC0000-0x0000000006F52000-memory.dmp

memory/236-47-0x0000000005830000-0x0000000005840000-memory.dmp

memory/456-46-0x0000000006F60000-0x0000000006FC6000-memory.dmp

memory/236-45-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/5020-49-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/456-48-0x00000000056D0000-0x00000000056E0000-memory.dmp

memory/2204-50-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6EB9.tmp

MD5	8f5942354d3809f865f9767eddf51314
SHA1	20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256	776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512	fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\tmp6ECE.tmp

MD5	8f7c33da3a9fc1fbfeea5db4ec4545c3
SHA1	37a3cdc4732b827aa2314481a75d7cd357a85b11
SHA256	e46d3efa4203b94ff6507efcc2a5fdc0c230c81f00fe12ab94d36eeb0cef773b
SHA512	bfc826f1a0b593620c10654395912297d270b6c8d0f3e61b84125fa59edeb16531f76a347069c25482b5fde00332398c7afc8ecd3afcffce75ec091caac7d823

C:\Users\Admin\AppData\Local\Temp\tmp6EEA.tmp

MD5	14ccc9293153deacbb9a20ee8f6ff1b7
SHA1	46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256	3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512	916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\tmp6F05.tmp

MD5	87210e9e528a4ddb09c6b671937c79c6
SHA1	3c75314714619f5b55e25769e0985d497f0062f2
SHA256	eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512	f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\Users\Admin\AppData\Local\Temp\tmp6EF0.tmp

MD5	22be08f683bcc01d7a9799bbd2c10041
SHA1	2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256	451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512	0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\Users\Admin\AppData\Local\Temp\tmp6FBD.tmp

MD5	d367ddfda80fdcf578726bc3b0bc3e3c
SHA1	23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256	0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512	40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/2180-413-0x0000000007C40000-0x0000000007CB6000-memory.dmp

memory/2180-414-0x0000000007D20000-0x0000000007D3E000-memory.dmp

memory/2204-415-0x000000001C9A0000-0x000000001C9B0000-memory.dmp

memory/2180-417-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/556-418-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/2204-420-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/4100-421-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/2180-419-0x00000000032E0000-0x00000000032F0000-memory.dmp

memory/4100-422-0x000000001CCE0000-0x000000001CCF0000-memory.dmp

memory/3892-424-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/240-426-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/4100-425-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/3480-427-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/3892-428-0x00000000057B0000-0x00000000057C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8550.tmp

MD5	4a8fbd593a733fc669169d614021185b
SHA1	166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256	714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512	6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\tmp854F.tmp

MD5	4300101a86a2f4e1f5e6ae2c1cde690c
SHA1	6070df58c530e8ae6feb69064f2a191b0dfb683d
SHA256	a225a0460aad9e52b24f0378c31ed1d26475e739af28731a2825020b744ed972
SHA512	21cd4e9de2a3ff7d933699775f0e27166c02b1eba4501a2f39141d77886d9e80763ca183336129c7772f7f7806f314ea06e506a508b78d232c4f37241de04ff4

C:\Users\Admin\AppData\Local\Temp\tmp8564.tmp

MD5	9276ef9a8ef150ff6e38fe050bce8129
SHA1	cb436abc6feca9f25255b66eed5ba9d37b6137e4
SHA256	f1a72c45ee4b09b1a0beff4ebf3637601f5aa457723a699f393fe05e7098b816
SHA512	12a05c485e658dacf2915c6b4d13ed1fa50979d4200933120aee366940335d647c9f33688601369d46572ca7dcd56c8a4883e67aa3c96eb3f241f7dd3e49a361

C:\Users\Admin\AppData\Local\Temp\tmp8554.tmp

MD5	327ab8c9cd745236ea2799a2a60d70ac
SHA1	cecf79071ecc41018456f46f598ca737a82d8710
SHA256	4c66213fe7e85a6714dfeef1bb072c154dc1998535bbd324c7c15e099b040c1b
SHA512	3938cecd1ea2bd0094f543a3cb7f40ef9141abf829f4e21cdaa4950f58508d3b92ff5f3f6dee6de62b41a309f6c8a25a163e6bdb4274b2aa7a358a33fc6c8c91

C:\Users\Admin\AppData\Local\Temp\tmp8553.tmp

MD5	87cbab2a743fb7e0625cc332c9aac537
SHA1	50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256	57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512	6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

C:\Users\Admin\AppData\Local\Temp\tmp8552.tmp

MD5	3b068f508d40eb8258ff0b0592ca1f9c
SHA1	59ac025c3256e9c6c86165082974fe791ff9833a
SHA256	07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512	e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\tmp8551.tmp

MD5	bfbc1a403197ac8cfc95638c2da2cf0e
SHA1	634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256	272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512	b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\tmp854E.tmp

MD5	a33e5b189842c5867f46566bdbf7a095
SHA1	e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256	5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512	f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\tmp854D.tmp

MD5	83ca7d5b103ac3734e4be801d96d489f
SHA1	1c9a271f32f45187cccea6b19edab5bd1de1a17a
SHA256	f5103733a552e44ca10abf28584092cb217bf42832e789714f38cdf916d95515
SHA512	50335a84e4eb7e90de77aef0bc703b4baf5c973b4bc6ff024599a98ac07884e7d856cd566e00bf9b1ba09b7225f7c6ef37c540f12fcf7a500d591315d223f011

memory/236-610-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/3480-611-0x0000000003F10000-0x0000000003F20000-memory.dmp

memory/3480-614-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/236-613-0x0000000005830000-0x0000000005840000-memory.dmp

memory/3132-615-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/3336-616-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/556-798-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/3132-799-0x000000001C350000-0x000000001C360000-memory.dmp

memory/720-801-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/3132-957-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/1060-956-0x00007FFD45150000-0x00007FFD45C12000-memory.dmp

memory/1060-985-0x000000001BF60000-0x000000001BF70000-memory.dmp

memory/2124-1015-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/240-1014-0x0000000074F60000-0x0000000075711000-memory.dmp

memory/240-1016-0x0000000004E40000-0x0000000004E50000-memory.dmp

Sample ID	240421-tddlnaeh8w
Target	slinkyloader.exe
SHA256	369b5e6e18c6f1b494147389106008ee284eb20e448d57dd8fd814b05884e7a8
Tags	redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Analysis Report

2024-09-11 08:47

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files