xtremerat | 01b340ad5b3fdf3bd074a19074ec6f153057fcb6e5200794bb1919939101a6f2

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
Size

810KB
MD5

0c96d62e3e3b0223c6bcab5b6c0dc304
SHA1

c00d22b41ccf49fb266dabed707e7c0a5f17fe2f
SHA256

01b340ad5b3fdf3bd074a19074ec6f153057fcb6e5200794bb1919939101a6f2
SHA512

cb292ec2d0747ac79300e52c999af24aedf5220bffafe23929f5e82c2fa2451c36bd0277c8648f7b03b47e979958b6cc68d7496b7fabdcbe60ef9797e7a3eba3
SSDEEP

12288:eUIVSdouDBYZUR9oK5MnyfeXRDtU+YLU3evyo1hn6PL5eWTu3oZ:SsdAZUR9t5MgkhGl4Syon6UWC3oZ

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2716-41-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

server.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	server.exe

Executes dropped EXE 64 IoCs

Processes:

server.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exe

pid	process
2636	server.exe
1204	server.exe
1428	server.exe
2616	server.exe
2684	server.exe
1776	server.exe
1972	server.exe
1412	server.exe
2084	server.exe
1208	server.exe
524	server.exe
2216	server.exe
1212	server.exe
1160	server.exe
3040	server.exe
1720	server.exe
1692	server.exe
1140	server.exe
2584	server.exe
2468	server.exe
2104	server.exe
2400	server.exe
1716	server.exe
2976	server.exe
2116	server.exe
2980	server.exe
2588	server.exe
1624	server.exe
1912	server.exe
828	server.exe
1060	server.exe
2932	server.exe
2232	server.exe
900	server.exe
1484	server.exe
3068	server.exe
2612	server.exe
3000	server.exe
2488	server.exe
2600	server.exe
2288	server.exe
2660	server.exe
760	server.exe
932	server.exe
2284	server.exe
1244	server.exe
1332	server.exe
876	server.exe
3024	server.exe
1872	server.exe
2188	server.exe
1592	server.exe
2316	server.exe
2052	server.exe
2412	server.exe
1200	server.exe
332	server.exe
2336	server.exe
928	server.exe
1928	server.exe
2092	server.exe
420	server.exe
1968	server.exe
2256	server.exe

Loads dropped DLL 4 IoCs

Processes:

VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeserver.exeserver.exe

pid process

2716 VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2716 VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2636 server.exe
1204 server.exe

pid	process
2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2636	server.exe
1204	server.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2716-40-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2716-41-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2716-38-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2716-35-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2716-34-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Adds Run key to start application 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\server.exe"	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exe

description	pid	process	target process
PID 2956 set thread context of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 set thread context of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 set thread context of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 set thread context of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 set thread context of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2636 set thread context of 1204	2636	server.exe	server.exe
PID 1204 set thread context of 1428	1204	server.exe	server.exe
PID 1428 set thread context of 2616	1428	server.exe	server.exe
PID 2616 set thread context of 2684	2616	server.exe	server.exe
PID 2616 set thread context of 1776	2616	server.exe	server.exe
PID 1972 set thread context of 1412	1972	server.exe	server.exe
PID 1412 set thread context of 2084	1412	server.exe	server.exe
PID 2084 set thread context of 1208	2084	server.exe	server.exe
PID 1208 set thread context of 524	1208	server.exe	server.exe
PID 1208 set thread context of 2216	1208	server.exe	server.exe
PID 1212 set thread context of 1160	1212	server.exe	server.exe
PID 1160 set thread context of 3040	1160	server.exe	server.exe
PID 3040 set thread context of 1720	3040	server.exe	server.exe
PID 1720 set thread context of 1692	1720	server.exe	server.exe
PID 1720 set thread context of 1140	1720	server.exe	server.exe
PID 2584 set thread context of 2468	2584	server.exe	server.exe
PID 2468 set thread context of 2104	2468	server.exe	server.exe
PID 2104 set thread context of 2400	2104	server.exe	server.exe
PID 2400 set thread context of 1716	2400	server.exe	server.exe
PID 2400 set thread context of 2976	2400	server.exe	server.exe
PID 2116 set thread context of 2980	2116	server.exe	server.exe
PID 2980 set thread context of 2588	2980	server.exe	server.exe
PID 2588 set thread context of 1624	2588	server.exe	server.exe
PID 1624 set thread context of 1912	1624	server.exe	server.exe
PID 1624 set thread context of 828	1624	server.exe	server.exe
PID 1060 set thread context of 2932	1060	server.exe	server.exe
PID 2932 set thread context of 2232	2932	server.exe	server.exe
PID 2232 set thread context of 900	2232	server.exe	server.exe
PID 900 set thread context of 1484	900	server.exe	server.exe
PID 900 set thread context of 3068	900	server.exe	server.exe
PID 2612 set thread context of 3000	2612	server.exe	server.exe
PID 3000 set thread context of 2488	3000	server.exe	server.exe
PID 2488 set thread context of 2600	2488	server.exe	server.exe
PID 2600 set thread context of 2288	2600	server.exe	server.exe
PID 2600 set thread context of 2660	2600	server.exe	server.exe
PID 760 set thread context of 932	760	server.exe	server.exe
PID 932 set thread context of 2284	932	server.exe	server.exe
PID 2284 set thread context of 1244	2284	server.exe	server.exe
PID 1244 set thread context of 1332	1244	server.exe	server.exe
PID 1244 set thread context of 876	1244	server.exe	server.exe
PID 3024 set thread context of 1872	3024	server.exe	server.exe
PID 1872 set thread context of 2188	1872	server.exe	server.exe
PID 2188 set thread context of 1592	2188	server.exe	server.exe
PID 1592 set thread context of 2316	1592	server.exe	server.exe
PID 1592 set thread context of 2052	1592	server.exe	server.exe
PID 2412 set thread context of 1200	2412	server.exe	server.exe
PID 1200 set thread context of 332	1200	server.exe	server.exe
PID 332 set thread context of 2336	332	server.exe	server.exe
PID 2336 set thread context of 928	2336	server.exe	server.exe
PID 2336 set thread context of 1928	2336	server.exe	server.exe
PID 2092 set thread context of 420	2092	server.exe	server.exe
PID 420 set thread context of 1968	420	server.exe	server.exe
PID 1968 set thread context of 2256	1968	server.exe	server.exe
PID 2256 set thread context of 1308	2256	server.exe	server.exe
PID 2256 set thread context of 1484	2256	server.exe	server.exe
PID 1628 set thread context of 2164	1628	server.exe	server.exe
PID 2164 set thread context of 1924	2164	server.exe	server.exe
PID 1924 set thread context of 844	1924	server.exe	server.exe
PID 844 set thread context of 940	844	server.exe	server.exe

Drops file in Windows directory 46 IoCs

Processes:

server.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File created	C:\Windows\InstallDir\server.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeVirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exeserver.exe

pid	process
2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2868	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
2636	server.exe
1204	server.exe
1428	server.exe
2616	server.exe
1776	server.exe
1972	server.exe
1412	server.exe
2084	server.exe
1208	server.exe
2216	server.exe
1212	server.exe
1160	server.exe
3040	server.exe
1720	server.exe
1140	server.exe
2584	server.exe
2468	server.exe
2104	server.exe
2400	server.exe
2976	server.exe
2116	server.exe
2980	server.exe
2588	server.exe
1624	server.exe
828	server.exe
1060	server.exe
2932	server.exe
2232	server.exe
900	server.exe
3068	server.exe
2612	server.exe
3000	server.exe
2488	server.exe
2600	server.exe
2660	server.exe
760	server.exe
932	server.exe
2284	server.exe
1244	server.exe
876	server.exe
3024	server.exe
1872	server.exe
2188	server.exe
1592	server.exe
2052	server.exe
2412	server.exe
1200	server.exe
332	server.exe
2336	server.exe
1928	server.exe
2092	server.exe
420	server.exe
1968	server.exe
2256	server.exe
1484	server.exe
1628	server.exe
2164	server.exe
1924	server.exe
844	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
    C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
        
        C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
        5⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2324
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2476
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2360
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2356
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2380
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2424
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2436
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2776
      - C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1652
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1712
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1412
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        15⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:2916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:1528
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        16⤵
        
        PID:3036
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1160
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        20⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2964
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2576
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        25⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:1276
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        26⤵
        
        PID:2464
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        28⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        30⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2144
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:896
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        35⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:2840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:2856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:1372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:1728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:2452
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:1808
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        36⤵
        
        PID:2884
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3000
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        38⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        40⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1952
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:932
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        45⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:2948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:1568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:2936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:1104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:1212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        46⤵
        
        PID:596
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1872
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        48⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        50⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2384
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:1640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:2620
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1200
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        55⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:1912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        56⤵
        
        PID:2212
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:420
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        58⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        60⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:1308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2592
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:1380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:1016
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        61⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        62⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        63⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        64⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:844
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        65⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:1636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:2944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:3024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:1644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        66⤵
        
        PID:1092
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        66⤵
        Drops file in Windows directory
        
        PID:880
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        67⤵
        Drops file in Windows directory
        
        PID:2180
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        68⤵
        
        PID:1224
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        69⤵
        
        PID:2368
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        70⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:2548
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:2392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:1580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:2988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:1976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:1948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        71⤵
        
        PID:1520
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        71⤵
        Drops file in Windows directory
        
        PID:1668
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        72⤵
        Drops file in Windows directory
        
        PID:1388
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        73⤵
        
        PID:2080
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        74⤵
        
        PID:964
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        75⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:1584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:1632
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        76⤵
        
        PID:2716
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        76⤵
        Drops file in Windows directory
        
        PID:1028
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        77⤵
        Drops file in Windows directory
        
        PID:1796
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        78⤵
        
        PID:2520
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        79⤵
        
        PID:1668
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        80⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:2456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:2844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:2496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:1984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:2040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:1832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:2648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        81⤵
        
        PID:2704
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        81⤵
        Drops file in Windows directory
        
        PID:2524
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        82⤵
        Drops file in Windows directory
        
        PID:1440
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        83⤵
        
        PID:2304
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        84⤵
        
        PID:2760
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        85⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:2348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:2584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:1704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:2160
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:2540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:2524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:2412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:1820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        86⤵
        
        PID:1100
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        86⤵
        Drops file in Windows directory
        
        PID:1540
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        87⤵
        Drops file in Windows directory
        
        PID:2276
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        88⤵
        
        PID:1796
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        89⤵
        
        PID:1196
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        90⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:2116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:1664
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:1684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:1784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:2860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        91⤵
        
        PID:1288
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        91⤵
        Drops file in Windows directory
        
        PID:2900
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        92⤵
        Drops file in Windows directory
        
        PID:792
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        93⤵
        
        PID:1540
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        94⤵
        
        PID:1628
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        95⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:2900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:2672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:1992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:1688
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:2516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:2196
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:1916
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        96⤵
        
        PID:1148
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        96⤵
        Drops file in Windows directory
        
        PID:2712
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        97⤵
        Drops file in Windows directory
        
        PID:2460
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        98⤵
        
        PID:2900
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        99⤵
        
        PID:3108
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        100⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3332
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        101⤵
        
        PID:3356
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        101⤵
        Drops file in Windows directory
        
        PID:3368
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        102⤵
        Drops file in Windows directory
        
        PID:3384
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        103⤵
        
        PID:3408
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        104⤵
        
        PID:3484
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        105⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        106⤵
        
        PID:3724
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        106⤵
        Drops file in Windows directory
        
        PID:3740
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        107⤵
        Drops file in Windows directory
        
        PID:3756
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        108⤵
        
        PID:3784
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        109⤵
        
        PID:3856
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        110⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4056
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:4088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        111⤵
        
        PID:3076
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        111⤵
        Drops file in Windows directory
        
        PID:632
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        112⤵
        Drops file in Windows directory
        
        PID:3084
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        113⤵
        
        PID:3096
        
        C:\Windows\InstallDir\server.exe
        
        "C:\Windows\InstallDir\server.exe"
        114⤵
        
        PID:3176
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        115⤵
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:3204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3460
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        116⤵
        
        PID:3476
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        115⤵
        
        PID:3264
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        110⤵
        
        PID:3940
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        105⤵
        
        PID:3568
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        100⤵
        
        PID:3188
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        95⤵
        
        PID:2012
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        90⤵
        
        PID:2624
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        85⤵
        
        PID:2184
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        80⤵
        
        PID:924
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        75⤵
        
        PID:1696
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        70⤵
        
        PID:956
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        65⤵
        
        PID:2684
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        60⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        50⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        45⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        40⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        35⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        30⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        20⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1140
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Windows\InstallDir\server.exe
        
        C:\Windows\InstallDir\server.exe
        10⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
        
        C:\Users\Admin\AppData\Local\Temp\VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\02fc8fb78d4f7516019d9a99eaf6a46d_4456596e-0528-4680-8940-5edc26c0ff50

Filesize
50B

MD5
0d07aceef41f39fddc179b4cee5a6143

SHA1
8dc81dd6d1f4a8d2cd06a374ed2504aa087761b8

SHA256
ae030038639228088c0ffd198200efad2f7f69f2ff909414ad2dbb6331d9a265

SHA512
0fcb788f2122ee8101dfbbbffc55960a1df4e4b3054c0803ac0b2dc244fd28018951c874700c6d5d7a7433d301c860d44db1a24761b0c53b68e18df0c81caade

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\699c4b9cdebca7aaea5193cae8a50098_4456596e-0528-4680-8940-5edc26c0ff50

Filesize
50B

MD5
5b63d4dd8c04c88c0e30e494ec6a609a

SHA1
884d5a8bdc25fe794dc22ef9518009dcf0069d09

SHA256
4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

SHA512
15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
99ebc5f2b6b8cff92c04cafc1944833f

SHA1
c552e666fb4cbba1181700f157972b28fbfa0333

SHA256
c9a5331cef39b19dd50fb834a64f887aedd416de1c8a0ba72248368d31f004f6

SHA512
14ed42aa7845fc5d6635556d9bc667ac9c38df72a074838253ae418cb9a1220aec30bf6314c13d1acffbe485663441e02998ef6267ca6be3892f7dfa32307dcf

Download Submit
\Windows\InstallDir\server.exe

Filesize
810KB

MD5
0c96d62e3e3b0223c6bcab5b6c0dc304

SHA1
c00d22b41ccf49fb266dabed707e7c0a5f17fe2f

SHA256
01b340ad5b3fdf3bd074a19074ec6f153057fcb6e5200794bb1919939101a6f2

SHA512
cb292ec2d0747ac79300e52c999af24aedf5220bffafe23929f5e82c2fa2451c36bd0277c8648f7b03b47e979958b6cc68d7496b7fabdcbe60ef9797e7a3eba3

Download Submit
memory/1204-94-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1428-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2512-25-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2512-57-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2716-38-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2716-40-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2716-42-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2716-33-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2716-41-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2716-35-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2716-34-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2864-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2864-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2868-53-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2868-47-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2868-45-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2868-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2868-43-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2868-258-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2992-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

description	pid	process	target process
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2956 wrote to memory of 2864	2956	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2864 wrote to memory of 2992	2864	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2992 wrote to memory of 2512	2992	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2716	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2512 wrote to memory of 2868	2512	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe
PID 2716 wrote to memory of 2324	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2324	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2324	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2324	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2324	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2476	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2476	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2476	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2476	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2476	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2360	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2360	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2360	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2360	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2360	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2356	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2356	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2356	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2356	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe
PID 2716 wrote to memory of 2356	2716	VirusShare_0c96d62e3e3b0223c6bcab5b6c0dc304.exe	iexplore.exe