xtremerat | cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Size

720KB
MD5

79a5196da396b96343044126f66d4edc
SHA1

a2a864d1aa86d2309c88c205de87b0024cb51522
SHA256

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1
SHA512

308c831918f71de6501ddc6983c2fca3aa727940a932f44cf5e7beb7a20e2860aa4b070778b4a1320315c3589ec8b2f97c1012cc2371d89b4d036b843f1af554
SSDEEP

12288:e+XbsaO1RUgWA6MKedpjpKNNt6vSR5SFgeiqRwMnJZQDx8XCj1B6CwbqR:Zr7WUZA6MKSWPNTDx8XCUbw

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3016-22-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/3016-20-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/3016-18-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/3016-23-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat
behavioral1/memory/3016-44-0x0000000000C80000-0x0000000000CC6000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 60 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe

Checks BIOS information in registry 2 TTPs 60 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Server.exe

Executes dropped EXE 58 IoCs

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

pid	process
2756	Server.exe
2116	Server.exe
1416	Server.exe
776	Server.exe
1376	Server.exe
824	Server.exe
1084	Server.exe
1960	Server.exe
2628	Server.exe
844	Server.exe
2176	Server.exe
2504	Server.exe
2924	Server.exe
2732	Server.exe
1636	Server.exe
1708	Server.exe
2232	Server.exe
2032	Server.exe
2620	Server.exe
1112	Server.exe
2944	Server.exe
2504	Server.exe
2788	Server.exe
2208	Server.exe
1840	Server.exe
936	Server.exe
1184	Server.exe
2804	Server.exe
1400	Server.exe
840	Server.exe
2536	Server.exe
2436	Server.exe
2744	Server.exe
2804	Server.exe
1636	Server.exe
1764	Server.exe
1552	Server.exe
1972	Server.exe
2640	Server.exe
1720	Server.exe
1704	Server.exe
1960	Server.exe
1628	Server.exe
2408	Server.exe
1628	Server.exe
1064	Server.exe
3180	Server.exe
3248	Server.exe
3392	Server.exe
3460	Server.exe
3608	Server.exe
3676	Server.exe
3820	Server.exe
3888	Server.exe
4036	Server.exe
3080	Server.exe
3280	Server.exe
3252	Server.exe

Loads dropped DLL 3 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exe

pid	process
3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
2756	Server.exe

Adds Run key to start application 2 TTPs 60 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Drops file in System32 directory 3 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeDllHost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\60433825_04big.jpg.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
File created	C:\Windows\SysWOW64\60433825_04big.jpg	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
File opened for modification	C:\Windows\SysWOW64\60433825_04big.jpg	DllHost.exe

Suspicious use of SetThreadContext 30 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	pid	process	target process
PID 2396 set thread context of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2756 set thread context of 2116	2756	Server.exe	Server.exe
PID 1416 set thread context of 776	1416	Server.exe	Server.exe
PID 1376 set thread context of 824	1376	Server.exe	Server.exe
PID 1084 set thread context of 1960	1084	Server.exe	Server.exe
PID 2628 set thread context of 844	2628	Server.exe	Server.exe
PID 2176 set thread context of 2504	2176	Server.exe	Server.exe
PID 2924 set thread context of 2732	2924	Server.exe	Server.exe
PID 1636 set thread context of 1708	1636	Server.exe	Server.exe
PID 2232 set thread context of 2032	2232	Server.exe	Server.exe
PID 2620 set thread context of 1112	2620	Server.exe	Server.exe
PID 2944 set thread context of 2504	2944	Server.exe	Server.exe
PID 2788 set thread context of 2208	2788	Server.exe	Server.exe
PID 1840 set thread context of 936	1840	Server.exe	Server.exe
PID 1184 set thread context of 2804	1184	Server.exe	Server.exe
PID 1400 set thread context of 840	1400	Server.exe	Server.exe
PID 2536 set thread context of 2436	2536	Server.exe	Server.exe
PID 2744 set thread context of 2804	2744	Server.exe	Server.exe
PID 1636 set thread context of 1764	1636	Server.exe	Server.exe
PID 1552 set thread context of 1972	1552	Server.exe	Server.exe
PID 2640 set thread context of 1720	2640	Server.exe	Server.exe
PID 1704 set thread context of 1960	1704	Server.exe	Server.exe
PID 1628 set thread context of 2408	1628	Server.exe	Server.exe
PID 1628 set thread context of 1064	1628	Server.exe	Server.exe
PID 3180 set thread context of 3248	3180	Server.exe	Server.exe
PID 3392 set thread context of 3460	3392	Server.exe	Server.exe
PID 3608 set thread context of 3676	3608	Server.exe	Server.exe
PID 3820 set thread context of 3888	3820	Server.exe	Server.exe
PID 4036 set thread context of 3080	4036	Server.exe	Server.exe
PID 3280 set thread context of 3252	3280	Server.exe	Server.exe

Drops file in Windows directory 2 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\Server.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
File created	C:\Windows\InstallDir\Server.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Server.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeDllHost.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Modifies registry class 64 IoCs

Processes:

Server.exeServer.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiLQWNOKGC\|vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqn{XRqKzf}FAp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiLQWNOKGC\|vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqj{XRqKVdXfN`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiOQWNOKGC\x7fvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqv{XRqKfMd\|sp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\ = "Setup Controller 14"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiFQWNOKGCvvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpz{XRqKm_fjy`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiYQWNOKGCivME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsB{XRqKuJ}HjP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiBQWNOKGCrvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpZ{XRqK\\{URe@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiJQWNOKGCzvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEq^{XRqKSpWBS@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiSQWNOKGCcvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErR{XRqKNqCD]P"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi]QWNOKGCmvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsb{XRqKDnNpvp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi\\QWNOKGClvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsn{XRqKlukVEp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiMQWNOKGC}vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqf{XRqK~\x7f}@}`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiQQWNOKGCavME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErB{XRqKVCZxS@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiIQWNOKGCyvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqF{XRqKO[Nxa@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiSQWNOKGCcvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErV{XRqKbsfdR@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiUQWNOKGCevME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErb{XRqKggi@O`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiXQWNOKGChvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsN{XRqK]QXnYP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiHQWNOKGCxvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqN{XRqKKBN~]P"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiIQWNOKGCyvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEqB{XRqKcYkXnP"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiZQWNOKGCjvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEs^{XRqKEcARW@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiYQWNOKGCivME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsF{XRqKYHXhe@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\InprocServer32	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiEQWNOKGCuvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpb{XRqKqt\x7fPK`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi\\QWNOKGClvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsj{XRqK@wNvJ`"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiNQWNOKGC~vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEq~{XRqKbTdzO`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiZQWNOKGCjvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsZ{XRqKiadrXP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi]QWNOKGCmvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsf{XRqKhlkPy`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\InprocServer32\ThreadingModel = "Both"	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiCQWNOKGCsvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpV{XRqKt`ptV@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiCQWNOKGCsvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpR{XRqKXbUTYP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiDQWNOKGCtvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEpj{XRqKum\x7fVwp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiPQWNOKGC`vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErN{XRqK~X\x7f^`@"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiPQWNOKGC`vME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErJ{XRqKRZZ~oP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiRQWNOKGCbvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErZ{XRqKJhCBa@"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiBQWNOKGCrvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEp^{XRqKpyprjP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi[QWNOKGCkvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsV{XRqKAzATkP"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJi^QWNOKGCnvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEsz{XRqKXEWJDp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiQQWNOKGCavME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErF{XRqKzA\x7fX\\P"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiTQWNOKGCdvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErj{XRqKc~iFsp"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiVQWNOKGCfvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fErz{XRqK{Lpz}`"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}\pExVk = "LKc~u@Ax{cPuEmVENRuaM}rkx^\|p\|\\J]m~{oVJiVQWNOKGCfvME{[x\x7f\|xyCtubUTXlPD]zi^I]F`bsuuBVt\x7fEr~{XRqKWNUZrp"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE07A9F-F9F2-1748-F9F2-1748F9F21748}	Server.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

description	pid	process
Token: 33	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Token: SeIncBasePriorityPrivilege	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
Token: 33	2756	Server.exe
Token: SeIncBasePriorityPrivilege	2756	Server.exe
Token: 33	1416	Server.exe
Token: SeIncBasePriorityPrivilege	1416	Server.exe
Token: 33	1376	Server.exe
Token: SeIncBasePriorityPrivilege	1376	Server.exe
Token: 33	1084	Server.exe
Token: SeIncBasePriorityPrivilege	1084	Server.exe
Token: 33	2628	Server.exe
Token: SeIncBasePriorityPrivilege	2628	Server.exe
Token: 33	2176	Server.exe
Token: SeIncBasePriorityPrivilege	2176	Server.exe
Token: 33	2924	Server.exe
Token: SeIncBasePriorityPrivilege	2924	Server.exe
Token: 33	1636	Server.exe
Token: SeIncBasePriorityPrivilege	1636	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2620	Server.exe
Token: SeIncBasePriorityPrivilege	2620	Server.exe
Token: 33	2944	Server.exe
Token: SeIncBasePriorityPrivilege	2944	Server.exe
Token: 33	2788	Server.exe
Token: SeIncBasePriorityPrivilege	2788	Server.exe
Token: 33	1840	Server.exe
Token: SeIncBasePriorityPrivilege	1840	Server.exe
Token: 33	1184	Server.exe
Token: SeIncBasePriorityPrivilege	1184	Server.exe
Token: 33	1400	Server.exe
Token: SeIncBasePriorityPrivilege	1400	Server.exe
Token: 33	2536	Server.exe
Token: SeIncBasePriorityPrivilege	2536	Server.exe
Token: 33	2744	Server.exe
Token: SeIncBasePriorityPrivilege	2744	Server.exe
Token: 33	1636	Server.exe
Token: SeIncBasePriorityPrivilege	1636	Server.exe
Token: 33	1552	Server.exe
Token: SeIncBasePriorityPrivilege	1552	Server.exe
Token: 33	2640	Server.exe
Token: SeIncBasePriorityPrivilege	2640	Server.exe
Token: 33	1704	Server.exe
Token: SeIncBasePriorityPrivilege	1704	Server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	3180	Server.exe
Token: SeIncBasePriorityPrivilege	3180	Server.exe
Token: 33	3392	Server.exe
Token: SeIncBasePriorityPrivilege	3392	Server.exe
Token: 33	3608	Server.exe
Token: SeIncBasePriorityPrivilege	3608	Server.exe
Token: 33	3820	Server.exe
Token: SeIncBasePriorityPrivilege	3820	Server.exe
Token: 33	4036	Server.exe
Token: SeIncBasePriorityPrivilege	4036	Server.exe
Token: 33	3280	Server.exe
Token: SeIncBasePriorityPrivilege	3280	Server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2800 DllHost.exe

pid	process
2800	DllHost.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exeServer.exeDllHost.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exeServer.exe

pid	process
2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
2756	Server.exe
1416	Server.exe
2800	DllHost.exe
2800	DllHost.exe
1376	Server.exe
1084	Server.exe
2628	Server.exe
2176	Server.exe
2924	Server.exe
1636	Server.exe
2232	Server.exe
2620	Server.exe
2944	Server.exe
2788	Server.exe
1840	Server.exe
1184	Server.exe
1400	Server.exe
2536	Server.exe
2744	Server.exe
1636	Server.exe
1552	Server.exe
2640	Server.exe
1704	Server.exe
1628	Server.exe
1628	Server.exe
3180	Server.exe
3392	Server.exe
3608	Server.exe
3820	Server.exe
4036	Server.exe
3280	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.execc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exeServer.exe

description	pid	process	target process
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 2396 wrote to memory of 3016	2396	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
PID 3016 wrote to memory of 1476	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 1476	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 1476	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 1476	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 1476	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2812	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2812	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2812	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2812	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2812	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2816	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2816	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2816	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2816	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2816	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2872	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2872	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2872	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2872	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2872	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2876	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2876	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2876	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2876	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2876	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2920	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2920	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2920	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2920	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2920	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2932	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2932	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2932	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2932	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2932	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2868	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2868	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2868	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2868	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	iexplore.exe
PID 3016 wrote to memory of 2756	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	Server.exe
PID 3016 wrote to memory of 2756	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	Server.exe
PID 3016 wrote to memory of 2756	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	Server.exe
PID 3016 wrote to memory of 2756	3016	cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe
PID 2756 wrote to memory of 2116	2756	Server.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
"C:\Users\Admin\AppData\Local\Temp\cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
  C:\Users\Admin\AppData\Local\Temp\cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1476
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2812
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2816
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2872
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2876
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2920
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2932
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2868
- - C:\Windows\InstallDir\Server.exe
    "C:\Windows\InstallDir\Server.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\InstallDir\Server.exe
      C:\Windows\InstallDir\Server.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2116
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2992
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:576
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1508
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:308
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2656
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2916
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2996
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2384
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1908
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:820
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2100
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1412
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2136
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:3040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:2624
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        11⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:2748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:644
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        13⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        14⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:3016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:3036
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        15⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        16⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:3068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2848
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:964
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        17⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        18⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:3048
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:980
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2416
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1376
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        19⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        20⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1084
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2524
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        21⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        22⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:2540
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        23⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        24⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2152
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1968
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        25⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        26⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:3044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2192
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:280
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1584
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        27⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        28⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1988
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2556
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        29⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        30⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2520
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:772
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2852
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1900
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        31⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        32⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1104
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2320
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        33⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        34⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2892
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2264
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        35⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        36⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:3008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:3012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2844
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        37⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        38⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1184
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2652
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        39⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        40⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:792
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        41⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        42⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:1492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2764
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2128
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        43⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        44⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1972
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:2448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:1636
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        45⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        46⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3032
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1644
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:1984
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        47⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        48⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3116
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3136
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3148
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3156
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3168
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        49⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        50⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3288
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3328
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3348
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3368
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3380
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        51⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3392
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        52⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3500
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3560
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3596
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        53⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3608
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        54⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3708
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3788
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3808
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        55⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3820
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        56⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4012
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4024
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        57⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4036
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        58⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3124
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3244
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3164
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        59⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3280
        
        C:\Windows\InstallDir\Server.exe
        
        C:\Windows\InstallDir\Server.exe
        60⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3516

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
5d18f99c7a8765b69c1690198ba7b0e5

SHA1
be3b54e7d7356ec36523dc2bef5ed37e2e9e955e

SHA256
3d1a0a6f727e4d4ccf7f1c44a387382ef00940ed6fac608b959d2e0c432a3a89

SHA512
bc7381c1af31245b684a2240b4b94fe2f0af8715af312713c6884fb1df239d3fe82e73a8ac586e1f7ff827bec1025d92a0f12bf88230637fdeabf4567c28d4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
9f2e704101258aa87bf4075173887db8

SHA1
23157a05936772552301e326d9795ee0b5a669be

SHA256
75022d13ac6851ddc9cf347bbf1cea4e79d6059a2458ee046015d746daa8f568

SHA512
2c1c522e9c50e29b1835f73f7971fb82cf5869a8d7aa0e4247897f513f51c5a76b08d19b7921a63e9a951e3976fb1b54667113b5ea6996b85ade76f29b55a887

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
57f817abbf74b43b7f342ec553312af4

SHA1
74515354a5c4e5e265b304c893726b6f612320df

SHA256
d19ba554473f61d4b68a11d2b782703ebd02a857759d5ce1b20bbe972f8ffed6

SHA512
ec3565203aa31672ab8b725a61424091585b2120ccf96c6bd989449227930ed4b9825f4c9a90cd09785619d4dcada3c3f05b9815592ac86f735562b92201ab33

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
d94d156984eb348fb222f21bf74febc0

SHA1
fc86cfa1bb41ab3ed7fb48574182ac9a47f3b2e2

SHA256
62285dee639a2cec037a023393c078b23511c80a67b919a0337995f53a9baf62

SHA512
79c85821b6194dae66290ccbd2c118526eb97d941dd8b0b58689e03c74e119cf22c5e39977c824263ec5ccf509e9e1c687ce2362c46f85d571534cf1de3e3d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
72e89fee31c339f9b783ecc583eb7d0e

SHA1
438c14638cfdfb4579851f374d1bd1dac589159c

SHA256
4f9ff65e1286bd6a7bcef80842bcad00c61da5ab906038ef0af606224cb6b3e5

SHA512
576ccb97e7b8d2f7604287db96712a6ea36db4ac043b8273746b9d870121fd3b92c372e35cf4d2343e15bffbd48a2352a43a727987da359e5abe98bdccd9ec52

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
0f6342a826824a801274f37481af7310

SHA1
84e71755df9b66c0961c6d91746dfbe368f09740

SHA256
a41ea4c9e3bab281c38e0033e64f6d6983994796c7d451068df7746afe8643b9

SHA512
23853e1f7b1334f54bdb6c44191ed470250f2a39325e7fe527645760e0a74bf6a2717ddbdeed659cb3b57661516f50bf1f3ccd97f8b1a5bfdd5a802fbe6b0ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
d586d505de16c0840baa41dc78d33931

SHA1
8764f87885e21b4298f29fac75cb8a9893149769

SHA256
16b953c132f990599dadb0e6c6b4b3f5d4c25068b91e8373c34f9596ba1eae66

SHA512
66bc0495d4c41d2d709fbebf4a1ee0e5e1d5badfe389645becbfdfb4044776164389b7ebfc278bde9f8ce3c24acc8cf8683bb38bcf489b2b35812a255824a534

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
b852f8061f1f724342a0f9fab397952a

SHA1
09f8518bf5d5dfa71a14687afd03a326562fb698

SHA256
4cb1f08d1fe11594c95cc2a1bc78d42e709caa7043dd89499cb2af121709a35a

SHA512
84824dacb5e6a796d9124abba79f4c41da9658b1d6c1c178f93f9779f40f7daeea19dad559293b01d4173664bc28c677e6da8017539af43c1dd38020225897c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
947244722547d4f660e9dae0f5717778

SHA1
becf4b0cae22e9303b871f18e53e4a5e5791649d

SHA256
91e2ed1547b1d2f06942e041c9f9ddc511caed6b712c63a22e5530b964082b40

SHA512
08f9a95197495c06a2210d55de09c7073b48aaa77049803a50e2585ae1ecdeb70cde766574b0e8eb93535a317ed82556cc36c60b35d11b59c921542fcdd2e580

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
9621188546f4f320266645fd4d36305d

SHA1
abcaba1a8b301f0bf3ec43d445b0b55f5768b949

SHA256
e459e60fc97288466fa44bf80f5795da6634b3c0d5cb99fcf03371bc979965ec

SHA512
9834ec2fbbd01f7e17a629d3fe49e7dd42db357f504ad65cd4a8c10e4b4d6e48b94304964f6393a74418b1c4c8c69a0ea476ec09dc3534ef6a9f1223ac45d8b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
5e3a4f7922231ff4b7188e2f01947965

SHA1
110584d2562bdc64fa6164c5ec92fe29c554d9b6

SHA256
d059ee4391b2e71b8ebc4a5e0bf005b3f68408b939123f9d25fbd93d8e76875f

SHA512
9cb2194e27515b190b4ef9f1b51da82f1ec6dae09f576dfd4f0d642b8c97fdef0583e81ef8451e5e81b6723b979a2cb09126db465f1af35cc31b88905f1817b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
a333d0aee88c0fbf03bf393e6cd0bc3b

SHA1
6ae11a6ab94110771b1239e31bbd4c0fffa185d9

SHA256
c35927696502b3ed37a2f16e6f1dde1c3ef893634b9eaac8eac91a09afec2e36

SHA512
b1a9a7c9846eb308e532f3f4153302b22dd76100fbf8600b0c014bbfa0c1e6329d20115fc200c9f0c92bf4a2a4a8751d8af115c317171656d428773dbef4a046

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
632ab00b6494d6c33350d1cb652f0216

SHA1
efdca61d60fa4b91f366cec13270ad6e837ecdb3

SHA256
78f953b9ef701d6a7635c1ffb42de2d70b18231f24b3afcecdeaaa267fa368c9

SHA512
9eca8c9446580470ee3033f7afc8b14e8cb8703a2077317f45d2c75594460f86b80025fc3947dd89ee04b276aba5947de9128a23f7e9f6ebf7582c5512134bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
fb51a02a9c093cefbaa4a0cac5bcd0cf

SHA1
b55eeda8292018fa2e3bf77540d3ad59bab5c5ce

SHA256
4c6f1ddeee6b44ac340177a0f5792073542397f166acdea8963f36f4d0508b8f

SHA512
57c7af3c961728011dae74c8b82a04cbd7e42ae5f7a1307ae04661af7505d36c807fa9b70b7bc76481e9c63dc879ee957710d42bfcdd81d6bba198b54ac55bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
a51bfa4803b515bc81d73ab1f5e5dd69

SHA1
99b24e11f2d13fb92e249163f76d29f56393f712

SHA256
61d2f3dcc62ae50d3fd98a80d98ca644790fadcffbb07e292aac4b456e6eb46b

SHA512
5f0a40ce6bd9e0b0c204340bc2a7e1446e9015cc0af397d880779851affe6856a3e2e3102fccbf5451b8724273ba2a1a2b7cf4a4aa24e6c5252bb20825c7a3e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\145D74A2.TMP

Filesize
72B

MD5
227c198dbbb029d002cd70cc7b1f1cb5

SHA1
f52033f82a4c48d4253fe6c6aa754ea63f66bd0d

SHA256
ec5203c268f535e301d9a386a094ba588c9580fb2afa90e4b7e72e10325a9e9d

SHA512
6edda5df0e43336e664d87e16554cabdcf9255570be9ef6d251313033d777bede56cd87093c6f093ec23abe1cf53819bde848e0c7908b6cd30db17751fc7c462

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
0ba42a03120e3b6b9b5f55b86a7d087d

SHA1
d5a5d1cd0bcf89cc7bd0c4920201c1cc7c2f27c4

SHA256
ef79caf60efe07ce9cd68403ae0d1ede11bf5c23c4f12909801d2ef6ed317ae9

SHA512
a3761d66a0a9d4590348e6f403dccfabd1b982eab2543fbd19c5d1bef0752ed6a12abf8d9d00529682804e9138a69749bb4159d076aada2dbbb34e4a81a3b637

Download Submit
C:\Windows\SysWOW64\60433825_04big.jpg

Filesize
205KB

MD5
91fa0e0f2ba3305e397a6f26c8fe3ee4

SHA1
e0b3e91c4106fad91fc872aeaee787d2e4210555

SHA256
03200b72d40d2e733ebf13494388eac37a98c9e72a7718e98a2bf3d500cb7c94

SHA512
5e9d93092349f5b4e87e92a17a0c434cf6342498cebac975774547d5b644a12e65cae49ec5d97c30683de016b7c28a7bbea278c85db04ccdbfb02bdba4e71e75

Download Submit
\Windows\InstallDir\Server.exe

Filesize
720KB

MD5
79a5196da396b96343044126f66d4edc

SHA1
a2a864d1aa86d2309c88c205de87b0024cb51522

SHA256
cc2711fdcb2faad489be94a39ad855c0923da38a86a7b1a9739aef3f51991dc1

SHA512
308c831918f71de6501ddc6983c2fca3aa727940a932f44cf5e7beb7a20e2860aa4b070778b4a1320315c3589ec8b2f97c1012cc2371d89b4d036b843f1af554

Download Submit
memory/1084-128-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1084-154-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1184-425-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-101-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-102-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1376-110-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-109-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-112-0x0000000000220000-0x0000000000269000-memory.dmp

Filesize
292KB

Download
memory/1376-111-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-126-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1376-115-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/1400-452-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1400-427-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1416-73-0x00000000002D0000-0x0000000000319000-memory.dmp

Filesize
292KB

Download
memory/1416-89-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/1416-99-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1416-98-0x00000000002D0000-0x0000000000319000-memory.dmp

Filesize
292KB

Download
memory/1416-93-0x00000000002D0000-0x0000000000319000-memory.dmp

Filesize
292KB

Download
memory/1416-83-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1416-80-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1416-84-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1416-85-0x00000000002D0000-0x0000000000319000-memory.dmp

Filesize
292KB

Download
memory/1416-88-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1416-82-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1552-554-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1628-628-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1628-653-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1628-627-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1636-262-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1636-241-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1636-530-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1704-603-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1704-579-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1840-378-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1840-398-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2176-208-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2232-288-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-7-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-6-0x0000000000680000-0x00000000006C9000-memory.dmp

Filesize
292KB

Download
memory/2396-26-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-16-0x00000000008C0000-0x00000000008C2000-memory.dmp

Filesize
8KB

Download
memory/2396-15-0x0000000000870000-0x0000000000872000-memory.dmp

Filesize
8KB

Download
memory/2396-17-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2396-13-0x0000000000680000-0x00000000006C9000-memory.dmp

Filesize
292KB

Download
memory/2396-8-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-24-0x0000000000680000-0x00000000006C9000-memory.dmp

Filesize
292KB

Download
memory/2396-9-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2396-10-0x0000000000680000-0x00000000006C9000-memory.dmp

Filesize
292KB

Download
memory/2396-19-0x00000000038C0000-0x00000000039A4000-memory.dmp

Filesize
912KB

Download
memory/2396-0-0x0000000000680000-0x00000000006C9000-memory.dmp

Filesize
292KB

Download
memory/2536-479-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2620-316-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2620-295-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2628-181-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2628-156-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2640-578-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2744-506-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2744-481-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2756-54-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2756-45-0x0000000001D50000-0x0000000001D99000-memory.dmp

Filesize
292KB

Download
memory/2756-52-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2756-55-0x0000000001D50000-0x0000000001D99000-memory.dmp

Filesize
292KB

Download
memory/2756-53-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2756-61-0x0000000002C00000-0x0000000002CE4000-memory.dmp

Filesize
912KB

Download
memory/2756-59-0x0000000001DC0000-0x0000000001DC2000-memory.dmp

Filesize
8KB

Download
memory/2756-58-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

Filesize
8KB

Download
memory/2756-62-0x0000000001D50000-0x0000000001D99000-memory.dmp

Filesize
292KB

Download
memory/2756-63-0x0000000001D50000-0x0000000001D99000-memory.dmp

Filesize
292KB

Download
memory/2756-69-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2756-67-0x0000000001D50000-0x0000000001D99000-memory.dmp

Filesize
292KB

Download
memory/2788-371-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2788-345-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2800-34-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2800-33-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2800-78-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2924-234-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2944-343-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2944-318-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3016-23-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/3016-42-0x00000000026D0000-0x00000000027B4000-memory.dmp

Filesize
912KB

Download
memory/3016-32-0x00000000029E0000-0x00000000029E2000-memory.dmp

Filesize
8KB

Download
memory/3016-18-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/3016-20-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/3016-22-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/3016-44-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Filesize
280KB

Download
memory/3016-21-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3180-677-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3280-798-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3392-701-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3608-725-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3820-749-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4036-750-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4036-774-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download