xtremerat | 2351ea88e204dd23c942610956d2d8a89761794c3db853b55dfd0dd3cd8fb538

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Size

742KB
MD5

409e0a90f1d77bfa0a64162fef75dee5
SHA1

fdd709f4f426784b8deddf13bbc9cc9ee0432b35
SHA256

2351ea88e204dd23c942610956d2d8a89761794c3db853b55dfd0dd3cd8fb538
SHA512

8f884a581eb6f2f910d572607826343b5cabc4ba6bb68f96e2f065c6c7a076492aea175243b21ab84760c1bb0c817af56b5283146c91f49daec500838faa4053
SSDEEP

12288:orgdNDEpK58V1oY++f/P3R6qhBA0fEpRRmh7yu4rLqXTViJ1iiB2tt/7OZSE5hVz:orUdEo+1o2J6qndEpReOuGO4vB2tt/7+

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	mxsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2028	explorer.exe

Executes dropped EXE 61 IoCs

pid	Process
4984	mxsetup.exe
2088	MxInstallOnline.exe
3248	Server.exe
3516	Server.exe
772	Server.exe
4244	Server.exe
1596	Server.exe
2920	Server.exe
4536	Server.exe
5092	Server.exe
1480	Server.exe
516	Server.exe
5016	Server.exe
3052	Server.exe
1576	Server.exe
4728	Server.exe
4592	Server.exe
4124	Server.exe
3856	Server.exe
2380	Server.exe
1272	Server.exe
4264	Server.exe
2836	Server.exe
4376	Server.exe
1380	Server.exe
1700	Server.exe
1352	Server.exe
2108	Server.exe
2892	Server.exe
4796	Server.exe
1744	Server.exe
976	Server.exe
4564	Server.exe
4220	Server.exe
1236	Server.exe
1804	Server.exe
1580	Server.exe
1600	Server.exe
1588	Server.exe
3448	Server.exe
4604	Server.exe
2124	Server.exe
2196	Server.exe
3784	Server.exe
1704	Server.exe
3088	Server.exe
1696	Server.exe
1792	Server.exe
2680	Server.exe
1600	Server.exe
3572	Server.exe
4476	Server.exe
2884	Server.exe
2808	Server.exe
832	Server.exe
4988	Server.exe
1448	Server.exe
4588	Server.exe
3984	Server.exe
3624	Server.exe
1796	Server.exe

Loads dropped DLL 64 IoCs

pid	Process
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
4984	mxsetup.exe
2088	MxInstallOnline.exe
2088	MxInstallOnline.exe
3248	Server.exe
3248	Server.exe
3248	Server.exe
3248	Server.exe
3248	Server.exe
3248	Server.exe
3248	Server.exe
4244	Server.exe
4244	Server.exe
4244	Server.exe
4244	Server.exe
4244	Server.exe
4244	Server.exe
4244	Server.exe
4536	Server.exe
4536	Server.exe
4536	Server.exe
4536	Server.exe
4536	Server.exe
4536	Server.exe
4536	Server.exe
516	Server.exe
516	Server.exe
516	Server.exe
516	Server.exe
516	Server.exe
516	Server.exe
516	Server.exe
5016	Server.exe
5016	Server.exe
5016	Server.exe
5016	Server.exe
5016	Server.exe
5016	Server.exe
5016	Server.exe
4124	Server.exe
4124	Server.exe
4124	Server.exe
4124	Server.exe
4124	Server.exe
4124	Server.exe
4124	Server.exe
1272	Server.exe
1272	Server.exe
1272	Server.exe
1272	Server.exe
1272	Server.exe
1272	Server.exe
1272	Server.exe
4376	Server.exe
4376	Server.exe
4376	Server.exe
4376	Server.exe
4376	Server.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe

Suspicious use of SetThreadContext 46 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1280 set thread context of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 3248 set thread context of 3516	3248	Server.exe	127
PID 3516 set thread context of 772	3516	Server.exe	128
PID 772 set thread context of 4604	772	Server.exe	131
PID 4244 set thread context of 1596	4244	Server.exe	133
PID 1596 set thread context of 2920	1596	Server.exe	134
PID 4536 set thread context of 5092	4536	Server.exe	161
PID 5092 set thread context of 1480	5092	Server.exe	163
PID 516 set thread context of 3052	516	Server.exe	185
PID 5016 set thread context of 1576	5016	Server.exe	186
PID 3052 set thread context of 4728	3052	Server.exe	187
PID 1576 set thread context of 4592	1576	Server.exe	188
PID 4728 set thread context of 1016	4728	Server.exe	190
PID 4124 set thread context of 3856	4124	Server.exe	195
PID 3856 set thread context of 2380	3856	Server.exe	196
PID 1272 set thread context of 4264	1272	Server.exe	220
PID 4264 set thread context of 2836	4264	Server.exe	223
PID 4376 set thread context of 1700	4376	Server.exe	244
PID 1700 set thread context of 1352	1700	Server.exe	249
PID 1352 set thread context of 3980	1352	Server.exe	252
PID 2108 set thread context of 2892	2108	Server.exe	254
PID 2892 set thread context of 4796	2892	Server.exe	255
PID 1744 set thread context of 976	1744	Server.exe	279
PID 976 set thread context of 4564	976	Server.exe	283
PID 4220 set thread context of 1804	4220	Server.exe	303
PID 1236 set thread context of 1580	1236	Server.exe	304
PID 1804 set thread context of 1600	1804	Server.exe	305
PID 1580 set thread context of 1588	1580	Server.exe	308
PID 1600 set thread context of 808	1600	Server.exe	307
PID 3448 set thread context of 4604	3448	Server.exe	314
PID 4604 set thread context of 2124	4604	Server.exe	315
PID 2196 set thread context of 3784	2196	Server.exe	339
PID 3784 set thread context of 1704	3784	Server.exe	342
PID 3088 set thread context of 1792	3088	Server.exe	363
PID 1792 set thread context of 2680	1792	Server.exe	367
PID 2680 set thread context of 4236	2680	Server.exe	369
PID 1600 set thread context of 3572	1600	Server.exe	371
PID 3572 set thread context of 4476	3572	Server.exe	372
PID 2884 set thread context of 2808	2884	Server.exe	396
PID 2808 set thread context of 832	2808	Server.exe	399
PID 4988 set thread context of 4588	4988	Server.exe	420
PID 1448 set thread context of 3984	1448	Server.exe	421
PID 4588 set thread context of 3624	4588	Server.exe	422
PID 3984 set thread context of 1796	3984	Server.exe	425
PID 3624 set thread context of 4904	3624	Server.exe	424

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4604-197-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-198-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-201-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-199-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-203-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-204-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-202-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-208-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-207-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-206-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-210-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4604-211-0x0000000001610000-0x0000000001715000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4972	1380	WerFault.exe	243
3452	1696	WerFault.exe	362

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MxInstallOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000b000000023c84-40.dat	nsis_installer_1
behavioral2/files/0x000b000000023c84-40.dat	nsis_installer_2
behavioral2/files/0x0007000000023cb9-139.dat	nsis_installer_1
behavioral2/files/0x0007000000023cb9-139.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4604	explorer.exe
4604	explorer.exe
1016	explorer.exe
1016	explorer.exe
3980	explorer.exe
3980	explorer.exe
808	explorer.exe
808	explorer.exe
4236	explorer.exe
4236	explorer.exe
4904	explorer.exe
4904	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
4604	explorer.exe
2920	Server.exe
1016	explorer.exe
2380	Server.exe
3980	explorer.exe
4796	Server.exe
808	explorer.exe
2124	Server.exe
4236	explorer.exe
4476	Server.exe
4904	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1608 wrote to memory of 1280	1608	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	86
PID 1280 wrote to memory of 4984	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	87
PID 1280 wrote to memory of 4984	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	87
PID 1280 wrote to memory of 4984	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	87
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 1280 wrote to memory of 636	1280	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	88
PID 4984 wrote to memory of 2088	4984	mxsetup.exe	89
PID 4984 wrote to memory of 2088	4984	mxsetup.exe	89
PID 4984 wrote to memory of 2088	4984	mxsetup.exe	89
PID 636 wrote to memory of 4100	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	90
PID 636 wrote to memory of 4100	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	90
PID 636 wrote to memory of 4100	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	90
PID 636 wrote to memory of 1744	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	91
PID 636 wrote to memory of 1744	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	91
PID 636 wrote to memory of 4036	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	92
PID 636 wrote to memory of 4036	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	92
PID 636 wrote to memory of 4036	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	92
PID 636 wrote to memory of 2028	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	93
PID 636 wrote to memory of 2028	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	93
PID 636 wrote to memory of 2028	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	93
PID 636 wrote to memory of 2028	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	93
PID 636 wrote to memory of 4428	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	94
PID 636 wrote to memory of 4428	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	94
PID 636 wrote to memory of 1760	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	95
PID 636 wrote to memory of 1760	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	95
PID 636 wrote to memory of 1760	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	95
PID 636 wrote to memory of 3520	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	96
PID 636 wrote to memory of 3520	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	96
PID 636 wrote to memory of 208	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	97
PID 636 wrote to memory of 208	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	97
PID 636 wrote to memory of 208	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	97
PID 636 wrote to memory of 212	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	98
PID 636 wrote to memory of 212	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	98
PID 636 wrote to memory of 4520	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	99
PID 636 wrote to memory of 4520	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	99
PID 636 wrote to memory of 4520	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	99
PID 636 wrote to memory of 4364	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	100
PID 636 wrote to memory of 4364	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	100
PID 636 wrote to memory of 2936	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	101
PID 636 wrote to memory of 2936	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	101
PID 636 wrote to memory of 2936	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	101
PID 636 wrote to memory of 4528	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	102
PID 636 wrote to memory of 4528	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	102
PID 636 wrote to memory of 1724	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	103
PID 636 wrote to memory of 1724	636	409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe	103

C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\mxsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\mxsetup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\MxInstallOnline.exe
      "C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\MxInstallOnline.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2088
- - C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\409e0a90f1d77bfa0a64162fef75dee5_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4428
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3520
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:212
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4528
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3156
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1644
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3516
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1648
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1576
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1272
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:592
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:380
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:736
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3520
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 824
        12⤵
        Program crash
        
        PID:4972
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1412
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3980
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2108
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:116
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2680
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        14⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        14⤵
        
        PID:3044
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:976
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:836
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4584
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:684
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:920
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:456
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:964
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 812
        12⤵
        Program crash
        
        PID:3452
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:380
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1224
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:400
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:808
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:624
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:5104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:772
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:1440
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        14⤵
        
        PID:964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        14⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        14⤵
        
        PID:3096
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:388
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:2544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:392
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:4036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        
        PID:3564
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4588
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 1380
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1696 -ip 1696
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Somebudu.dll

Filesize
5KB

MD5
fa012d4b6012d52ddb5a68cc8c31292c

SHA1
e23498959b742b6c14e122d3d2384ba364da165a

SHA256
abf7143775c079378153f9800fe706ad17b9b1a12d54c8ba2f87164d46f09df0

SHA512
d03736d1294c4f123dcb29d223e5159ec5d01bc69e4d7c158504a2748cf15bb95fb3293137f09cae9bbfff1f1b5a80a6f185ced9e5f33189e0078ac71aaba032

Download Submit
C:\Users\Admin\AppData\Local\Temp\foleyolet.dll

Filesize
3KB

MD5
17dfc5ea607c7be7441a90bb0f90e388

SHA1
a348f29a39f2e1b8b81f52c8f333909bfdf4f0e9

SHA256
a18b1c6593bda967f15f212bdf63ed5f9032bc945477922807bf7fbc8b9f7cda

SHA512
84cf74275ac905073b50a2ec8438418f21befce1865a5dcfa4d120ba93d5d1297cbbb8211ace4945c44cd5415a135e30fe08def8e4ec92213aa9ba8ffa617a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxsetup.exe

Filesize
292KB

MD5
3bf24a621ead96af3ffa33d1de194eb9

SHA1
a73d862768f79fd17163a8a38604423c6e92beff

SHA256
c05735b853122ab00981fa9bf255590b8c4881dce033bced85d7161ad39aa6c3

SHA512
64b35e269cf148c1399866e6e4ba98ed8dd8d46e817ac7320a2db6d28b5ae8f3bcda39f972890df93c78915a2b4941e06e52c5da550a2196a0d5604304905243

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscCC0B.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\Language\en.ini

Filesize
3KB

MD5
11182f27c18af8ae16d8e9ecb5d13cb4

SHA1
2b3f01bbfc93abf7114d3088e858c024c4ee2269

SHA256
c8349da0cc664d838cc992e19e59658e0222de9695d1db5174969c4f027dc666

SHA512
90695e726caacdaea36363a6b832d48d758f414a5e3ff2fb8950c36d97a9269b8265faf22d5d6d7c2ffde2fd883129a7f712b65d354a8ea697e22fbc73c03bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\StartMxonline.ini

Filesize
23B

MD5
947708030b99032a0bdd278caa3dc97c

SHA1
4c72b80a0d5fe519f2bcbb1dc4c9a5e0a3fe7f6d

SHA256
b2946511dc16dd97a2b62ae152d6073279e261e8f0b6168c62f29d26c9bcbfe4

SHA512
317db92c2e8860d7e09ccfaa787ef1ea99a699025126a6eb3228cb45c672b64b0dd1656f6ad2f51be737770678ddcf17332debf7e79e0daed7ad4a25246d02d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\MxEncodeS.dll

Filesize
89KB

MD5
e6e9ff42656fba9bc8cc7ac2febfe2d0

SHA1
14f034b295d03a5018765aa1513d9fb7546b5b1d

SHA256
f3e7c33e7c6a9d6f2519bf46322b9c18a2470d66532124f9ede9218313012e16

SHA512
f7bc55163210eae3afefd6fd860bb70e1b79497ac5074f2bb8a0a88540accb328657d446f131ec91b95be93c963f8ee3461e05a47261bcc71e7c28bf9da41230

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\MxHttpRq.dll

Filesize
109KB

MD5
d42caadf2661c604d3641513b91a3125

SHA1
2833d59c4b47ce3ddab24fdebb6bd42e7921bf41

SHA256
a4d7ea08ac9157c4fcd7fb6c68e1f7a7702750c2dd31bd073a5f3fc5c5fa93a2

SHA512
489aa48996497eec2cda5ca48df361c730088720aa762d863f8d81ef412e3ed4a1e2ac7f3b9db215e387c17816fc2410e959004cf219e02b2f20cccc8a14d3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\MxInstallOnline.exe

Filesize
400KB

MD5
6d41dc7a96d957cbbe4703e7ec1dcd9f

SHA1
ed590576ad4c43ba777b2498a3fa59ec769d2bc8

SHA256
36251a533d3630d6d3d2280385a20fbd23407d02e5764b44bacc224f916b84d7

SHA512
e3395b45315eaa35c3232fd657af97152c5825226a71df8ae47e1b5e45fdab56bb06f16b2ba7e1ca74dd1c7963f9aff0eac3a53a76cd8e1cf08fb4e6d9b2cc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\ProgressBk.png

Filesize
201B

MD5
f52340ad4f6b1aa0e5184dd54ae87623

SHA1
a3ee5b0c7a9a29e235aaec727c43ad3d35446d9b

SHA256
97bcdf7d2b41c505506d69eb08d643d31ec32f08e9eb9f2cc9a6d2b05f5fb4f9

SHA512
a74afdd7b046812c4e35a0a02fc7c9cbfe6f1640c03cb72c9663f1d01c1dea964287ffb0fc894dfcbd52545d0c865b32370ecb44d3fc91a4be70ab114cf4d71b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\ProgressStep.png

Filesize
159B

MD5
f1db901f48cc3bfd1656c5dc880112d5

SHA1
8e10f2cd53aa654cfcef3a68c3b20c09bad50287

SHA256
7cf5f38a911fe153e9f1b51ab3806b0f5e65fa7a3a6e3a756fc7018300e0a252

SHA512
d5eaf6bc9a57eccb22c9468f65815015981ff2ff572ee8152611af9f8fdb222093b3d20e2629832beaf563f892dd7454064013ae252c40b47538b51f3767bb94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\background.png

Filesize
1KB

MD5
43cc745297a9ed49bf484da25fea5cc9

SHA1
56e49c38d694eb201eaf26c9dc7bb130523c1cf1

SHA256
81b21b8e9937ae7e66dc5d2187a163d6ba34905afd26e175b72001f2fe51a51d

SHA512
9627b8ede85b5fc944ebde7229b45f194231177d7baac77c84360997ca7395f2bcaa81a17fdd37b255063373a82b40566ba0bf2a2a9ebeb21a1d05518a15ce43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\close.png

Filesize
347B

MD5
0e2bf9500c9810e540c2f04260b4c9ab

SHA1
5fc89632bf6096ca8fac69a92f62d56fb5dd2ec0

SHA256
1bfc48600788cf5ff0bfdf3fa7b29bff205746b98b1e7a4cd3b34e494cde55e4

SHA512
3f7a8d27629558b53c8a345df251639abad12da82a0ad3b0da222c3836e359eadf8e90763d8a7d23b7c9416df832085c9fd29dccb4f4326317b0c17043d6db4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\close_active.png

Filesize
1KB

MD5
1bf824c445eed11004d1b49960be5b06

SHA1
9ef8c11c5d7542a131e66174230cf12aaa204aa8

SHA256
6fa699af4ed49bab4e9697704e940cc71d3a31c1836c7f95a6795f0e73f511a5

SHA512
4e36697eaa1e57d4ca954da22e6c974ce4441ac201dcd1d91d63d329e326257a1b29fd08c8bfe13d60c953e1ecbc6e2e21bcb6c04badde8f4d741f5f89bb07a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\close_hover.png

Filesize
336B

MD5
2af9d6317e7bb3c9797122a2e37313d1

SHA1
a44ed1fde56610e4cbadac84152edd8889c0bfac

SHA256
a4b0644d1b5189b5bcd09c3fd0120b55eeb20f39546d6705a487a2580c47cc1a

SHA512
daf698a344d0c055d58d63504667d7a6848ac985effd9374f72fa0da4547f9e2dc3f2450734d27b140b601a23f5c53dbe6ca5588e41085a8de8a2ca8338df8b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\en.png

Filesize
3KB

MD5
92424a213ef4b40153a9a9904479409b

SHA1
b260b55b8633a6b0a95fc9bae877d510ae63a072

SHA256
4a9ebe695a4f1bd997720072e2891341af0a5a647a6d9268064692ff42df80e0

SHA512
0f777bdaea208e75f00aed9cd8676bf79d757dc5769d0f3306e84734be44f3d79d7c047e281b1fc7309888e3adbe082e7219dffd6cd6031b5fa634f29635ed66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\img\logo.png

Filesize
916B

MD5
5a1cb3aff61c04d831e4dea2b62f3942

SHA1
874eed1183e21f4a856cb97beec6f413724d2ca6

SHA256
16aa579c30d9730f6d735f69060e1fac922a65956409c24904ce3871f5f9bc57

SHA512
9523ae8bb18af7e8ac44330bb329cdde333bf74975a310cc930e51f7789ce28baa4ac61626f2cc49a57bcf98fb3dca8d7ceeea0f7e789e40bd2e3fdf7fdfeb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD275.tmp\install_data\inscfg.ini

Filesize
226B

MD5
912d3eae481b7b9342f22fd4f204e34a

SHA1
6dde25fa934e7bf3524f58a6273e256277870b7f

SHA256
c42f49933f29b8119ffae893dfbdf650183b233403cfdd0be009dcb0906aea68

SHA512
58dc9291b5519d627979bd999f04568fcd7b9560b97f7f513e2bed9b12f300c6eae9f8600f12143d60453f2fbbe659e1f13c15919d8b4f834576d2620b73e9d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tukadeku.dll

Filesize
3KB

MD5
ca8b761d4d06343c413f8ceea0b63884

SHA1
4601ce2ae93cd729a0c63e4d4cba8bcff53685aa

SHA256
468dee4f6ba0fbe94a878f71b92762ca5e0850187c2be4e0bbec4fc72e20be77

SHA512
1fca2f4b717dcf111082fa40d2141d5fcffad4c64cb3191fb6b03d1345448cfc68e48ee9afb783e0f4e44d7d269153e2c6333b8c714052a43c448fd650067e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\zolizem.wef

Filesize
670KB

MD5
61255b991c241f32e932567c4a395b8d

SHA1
a5611f1de3bd0292b27878c124516e3c2d93b093

SHA256
24d3dad26a6adf8cb9c295175a2736657252c6ce89ba04260ca2d9722759541a

SHA512
db615f1849d78b80a23b798bb2b14ece245c3b3f1b87bc43db0f8c20323addfab24276d026ecf77354426331d1daa2d32096415a06fede8810cd7ce91f79f2c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\GXWB9ipAr9\GXWB9ipAr9.dat

Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\GXWB9ipAr9\GXWB9ipAr9.nfo

Filesize
3KB

MD5
cfb22b74b14794a5129ebba4782fe8ef

SHA1
b4f760348b49cbba239d4cd62e588c2049818441

SHA256
3e227f9e22c9c2e71bd0692fa01fba63912a2483b93728a1e1ab9717ba1e37d9

SHA512
2ac32f3d02287fb2bdbe7a6a38151faf24b574313a3ea3818af3844ac9d1c240bbe915e838cfeebfc9fe90d8a1755a946a144abe34bc01b2bcf31de405a3c3d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\GXWB9ipAr9\GXWB9ipAr9.svr

Filesize
346KB

MD5
b6d63330959896290103db9786bd33d6

SHA1
b2558e1b4c6d9e012801a6e6564cf44fa16d6d14

SHA256
38d68f85dd0d99524efb7b537ce8fc5c7494126da1455a8d700cec51ef021c24

SHA512
54cd768f2df8e7e570a95073e1727465c6c22945334e33b835608b8933ef81d59eb33b3b5b434dde5c8b2f25130b417a076916fa4b7fcd9c33a133681cecc9b2

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
742KB

MD5
409e0a90f1d77bfa0a64162fef75dee5

SHA1
fdd709f4f426784b8deddf13bbc9cc9ee0432b35

SHA256
2351ea88e204dd23c942610956d2d8a89761794c3db853b55dfd0dd3cd8fb538

SHA512
8f884a581eb6f2f910d572607826343b5cabc4ba6bb68f96e2f065c6c7a076492aea175243b21ab84760c1bb0c817af56b5283146c91f49daec500838faa4053

Download Submit
memory/636-97-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/636-99-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/636-70-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/636-132-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/636-87-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/636-175-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1280-35-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1280-30-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1280-34-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/2028-128-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2920-313-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2920-285-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4604-199-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-201-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-203-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-204-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-202-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-208-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-198-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-207-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-206-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-210-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-211-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4604-197-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4656-195-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download