Overview

overview

10

Static

static

10

newest.exe

windows7-x64

10

newest.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 06:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    newest.exe

  • Size

    93KB

  • MD5

    173883b31d172e5140f98fd0e927ff10

  • SHA1

    1e477ebc749e1ef65c820cfb959d96ffc058b587

  • SHA256

    984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08

  • SHA512

    01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a

  • SSDEEP

    1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngS:XFJMnnwlOUWT0hi1dzg

Score
8/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 64 IoCs
    evasion
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 43 IoCs
  • Drops file in Program Files directory 43 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newest.exe
    "C:\Users\Admin\AppData\Local\Temp\newest.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
          PID:4468
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4188
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
          3⤵
            PID:4232
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4228
            • C:\Users\Admin\AppData\Local\Temp\server.exe
              "C:\Users\Admin\AppData\Local\Temp\server.exe"
              4⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:680
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4676
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1516
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                5⤵
                • Modifies Windows Firewall
                PID:2224
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5068
                • C:\Users\Admin\AppData\Local\Temp\server.exe
                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                  6⤵
                  • Checks computer location settings
                  • Drops startup file
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3256
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                    7⤵
                    • Modifies Windows Firewall
                    • System Location Discovery: System Language Discovery
                    PID:832
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                    7⤵
                      PID:1728
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                      7⤵
                        PID:2500
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                        7⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4460
                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                          8⤵
                          • Checks computer location settings
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3976
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            9⤵
                            • Modifies Windows Firewall
                            • System Location Discovery: System Language Discovery
                            PID:5052
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                            9⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:4288
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            9⤵
                            • Modifies Windows Firewall
                            • System Location Discovery: System Language Discovery
                            PID:996
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:416
                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                              10⤵
                              • Checks computer location settings
                              • Drops startup file
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2264
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                11⤵
                                  PID:4140
                                • C:\Windows\SysWOW64\netsh.exe
                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                  11⤵
                                  • Event Triggered Execution: Netsh Helper DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:2080
                                • C:\Windows\SysWOW64\netsh.exe
                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                  11⤵
                                  • Modifies Windows Firewall
                                  • Event Triggered Execution: Netsh Helper DLL
                                  PID:4828
                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                  11⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  PID:4992
                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Drops file in Program Files directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3460
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                      13⤵
                                      • Modifies Windows Firewall
                                      PID:3764
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                      13⤵
                                      • Event Triggered Execution: Netsh Helper DLL
                                      PID:1916
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                      13⤵
                                      • Modifies Windows Firewall
                                      PID:3944
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                      13⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:3520
                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Drops file in Program Files directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4604
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                          15⤵
                                          • Modifies Windows Firewall
                                          • System Location Discovery: System Language Discovery
                                          PID:2404
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                          15⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          PID:1892
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                          15⤵
                                            PID:3572
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                            15⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3976
                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Program Files directory
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3584
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                17⤵
                                                  PID:4048
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                  17⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2276
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                  17⤵
                                                    PID:4140
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                    17⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    PID:904
                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                      18⤵
                                                      • Checks computer location settings
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4896
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                        19⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3192
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                        19⤵
                                                          PID:4936
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                          19⤵
                                                          • Modifies Windows Firewall
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4416
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                          19⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          PID:3112
                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                            20⤵
                                                            • Checks computer location settings
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4520
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                              21⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1088
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                              21⤵
                                                              • Modifies Windows Firewall
                                                              PID:4036
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                              21⤵
                                                                PID:2228
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:4432
                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                  22⤵
                                                                  • Checks computer location settings
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1716
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                    23⤵
                                                                      PID:4200
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                      23⤵
                                                                      • Modifies Windows Firewall
                                                                      PID:2336
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                      23⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2320
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                      23⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:528
                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                        24⤵
                                                                        • Checks computer location settings
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2992
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                          25⤵
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:1400
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                          25⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5080
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                          25⤵
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3256
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                          25⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3068
                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                            26⤵
                                                                            • Drops startup file
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Program Files directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1888
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                              27⤵
                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                              PID:3864
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                              27⤵
                                                                                PID:956
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                27⤵
                                                                                • Modifies Windows Firewall
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:1440
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                27⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4232
                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                  28⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops startup file
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1416
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                    29⤵
                                                                                      PID:3948
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                      29⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4716
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                      29⤵
                                                                                      • Modifies Windows Firewall
                                                                                      PID:224
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                      29⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3128
                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                        30⤵
                                                                                        • Checks computer location settings
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1516
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                          31⤵
                                                                                          • Modifies Windows Firewall
                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                          PID:1708
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                          31⤵
                                                                                          • Modifies Windows Firewall
                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3408
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                          31⤵
                                                                                          • Modifies Windows Firewall
                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                          PID:2940
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                          31⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4532
                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                            32⤵
                                                                                            • Checks computer location settings
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4328
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                              33⤵
                                                                                                PID:4552
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                33⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:4940
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                33⤵
                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4424
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                33⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3864
                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                  34⤵
                                                                                                  • Drops startup file
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1472
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                    35⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    PID:1932
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                    35⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1612
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                    35⤵
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2140
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                    35⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4376
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                      36⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Drops startup file
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4676
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                        37⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4108
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                        37⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:2712
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                        37⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:4400
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                        37⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4312
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                          38⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Drops startup file
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4416
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                            39⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            PID:2148
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                            39⤵
                                                                                                              PID:508
                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                              39⤵
                                                                                                              • Modifies Windows Firewall
                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4500
                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                              39⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4064
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                40⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Drops startup file
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2280
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                  41⤵
                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                  PID:2396
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                  41⤵
                                                                                                                  • Modifies Windows Firewall
                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                  PID:4824
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                  41⤵
                                                                                                                  • Modifies Windows Firewall
                                                                                                                  PID:3736
                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                  41⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3572
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                    42⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Drops startup file
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2736
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                      43⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      PID:4444
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                      43⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                      PID:2624
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                      43⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                      PID:3248
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                      43⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4660
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                        44⤵
                                                                                                                        • Drops startup file
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2128
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                          45⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          PID:4752
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                          45⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                          PID:3164
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                          45⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:904
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                          45⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2188
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                            46⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Drops startup file
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2116
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                              47⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3224
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                              47⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1920
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                              47⤵
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4788
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                              47⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2588
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                48⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Drops startup file
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:3316
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                  49⤵
                                                                                                                                    PID:4300
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                    49⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                    PID:3084
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                    49⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:4832
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                    49⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:208
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                      50⤵
                                                                                                                                      • Drops startup file
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:224
                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                        51⤵
                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                        PID:4796
                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                        51⤵
                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1940
                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                        51⤵
                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                        PID:4368
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                        51⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1872
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                          52⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Drops startup file
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3400
                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                            53⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                            PID:2800
                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                            53⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            PID:5024
                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                            53⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                            PID:3164
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                            53⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2188
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                              54⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Drops startup file
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2428
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                55⤵
                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:896
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                55⤵
                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                PID:4940
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                55⤵
                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                PID:4700
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                55⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1436
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                  56⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:4976
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                    57⤵
                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2228
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                    57⤵
                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4680
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                    57⤵
                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                    PID:4984
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                    57⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4008
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                      58⤵
                                                                                                                                                      • Drops startup file
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:680
                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                        59⤵
                                                                                                                                                          PID:316
                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                          59⤵
                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                          PID:3140
                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                          59⤵
                                                                                                                                                            PID:2216
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                            59⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:224
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                              60⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Drops startup file
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2744
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                61⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                PID:2992
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                61⤵
                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                PID:2456
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                61⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                PID:64
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                61⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1716
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                  62⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:2176
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                    63⤵
                                                                                                                                                                      PID:4748
                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                      63⤵
                                                                                                                                                                        PID:4156
                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                        63⤵
                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2516
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                        63⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4548
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                          64⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Drops startup file
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2540
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                            65⤵
                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                            PID:4468
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                            65⤵
                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3372
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                            65⤵
                                                                                                                                                                              PID:3316
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                              65⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4376
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                66⤵
                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:4772
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                  67⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1976
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                  67⤵
                                                                                                                                                                                    PID:3288
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                    67⤵
                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                    PID:4012
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                    67⤵
                                                                                                                                                                                      PID:4508
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                        68⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:3080
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                          69⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2908
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                          69⤵
                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                          PID:2456
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                          69⤵
                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                          PID:4476
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                          69⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1788
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                            70⤵
                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:3144
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                              71⤵
                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                              PID:4824
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                              71⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4156
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                              71⤵
                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                              PID:3976
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                              71⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              PID:2360
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                72⤵
                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1472
                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3028
                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:4376
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                PID:2148
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:4424
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                      PID:3580
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                PID:2948
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                      PID:2160
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                PID:3888

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
                                                                        Filesize

                                                                        496B

                                                                        MD5

                                                                        a4467dea22bfd7e0083d680c571f5e7c

                                                                        SHA1

                                                                        59682ca656f04dd57f7ef4552b96f71d73196ea2

                                                                        SHA256

                                                                        d165b248678c73e289a7d4a8aa74acc5c09408e58b8f2abd668013ca12c00cc4

                                                                        SHA512

                                                                        73d25a179994c16b2b3a357e8b068ebf415418033cd601d7084b3a44d822cb99c33c396c9a27ad6fa2066748032e21f09ce89461bc3180ec071d2d64e68ad790

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log
                                                                        Filesize

                                                                        408B

                                                                        MD5

                                                                        661cab77d3b907e8057f2e689e995af3

                                                                        SHA1

                                                                        5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c

                                                                        SHA256

                                                                        8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2

                                                                        SHA512

                                                                        2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\melt.txt
                                                                        Filesize

                                                                        44B

                                                                        MD5

                                                                        298802dff6aa26d4fb941c7ccf5c0849

                                                                        SHA1

                                                                        11e518ca3409f1863ebc2d3f1be9fb701bad52c0

                                                                        SHA256

                                                                        df99fdbdf7b92b29b1bf1ca4283b4de2e04643b9739d2d1089ab5808e8e5665d

                                                                        SHA512

                                                                        0301017dfef1b74855d6535f3fd542257689479cb933c2e8742b5b6b94e26107fa38e7fc21bdb83d45184750eced344856092330fb30a1ebbc24b2b9004c8946

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                        Filesize

                                                                        93KB

                                                                        MD5

                                                                        173883b31d172e5140f98fd0e927ff10

                                                                        SHA1

                                                                        1e477ebc749e1ef65c820cfb959d96ffc058b587

                                                                        SHA256

                                                                        984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08

                                                                        SHA512

                                                                        01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\app
                                                                        Filesize

                                                                        5B

                                                                        MD5

                                                                        02b81b0cbe1faaa1fa62d5fc876ab443

                                                                        SHA1

                                                                        d473cfe21fb1f188689415b0bdd239688f8fddd9

                                                                        SHA256

                                                                        e7e9e2c247bc872bacce77661c78f001a17d70ee3130a9016a5818da9da00cdb

                                                                        SHA512

                                                                        592ab5b200d4c560951cb70288dc1b7a562f0cbfaee01ce03076b6934d537b88575c2e1e0fedcc05db95e6c224ca739923e7d74f9165e683f3fbad7bbf641784

                                                                        Download Submit

                                                                      • memory/1716-15-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/1716-16-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/1716-14-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/1716-51-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/3572-0-0x0000000075492000-0x0000000075493000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3572-13-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/3572-2-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download

                                                                      • memory/3572-1-0x0000000075490000-0x0000000075A41000-memory.dmp

                                                                        Filesize

                                                                        5.7MB

                                                                        Download