Overview

overview

8

Static

static

1

2026-08-28...yp.exe

windows10-2004-x64

8

2026-08-28...yp.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_0af9089a36b57c8d44ee480a94f3ff73_amadey_cloudeye_darkgate_elex_glassworm_icedid_manuscryp.exe
  • Size 37.3MB
  • Sample260828-2f7araec78
  • SHA256 88f955524b30c14142f989b45f4654afbdba1052d76412e8020ba55117b0a58f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 16 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 1 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_0af9089a36b57c8d44ee480a94f3ff73_amadey_cloudeye_darkgate_elex_glassworm_icedid_manuscryp.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_0af9089a36b57c8d44ee480a94f3ff73_amadey_cloudeye_darkgate_elex_glassworm_icedid_manuscryp.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c run.bat > "C:\Users\Admin\AppData\Local\Temp\unpack.log.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\unpack\PreVerCheck.exe
        PreVerCheck.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec /norestart /i "setup.msi" /qb! /l*v "C:\Users\Admin\AppData\Local\Temp\PreVer.log.txt" CA_EXTPATH=1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1632
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5012
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0757F88CA21BFD3A0DF4C7F10D3E6540
      2⤵
      • Badlisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0BB5B11-1A36-4E91-9E3E-A6C90081D78A}
        3⤵
        • Executes dropped EXE
        PID:3264
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D2DC228-E12B-41F3-8A59-D2924593B051}
        3⤵
        • Executes dropped EXE
        PID:3396
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2D117F2F-FAB3-4C60-997D-5A30C853362D}
        3⤵
        • Executes dropped EXE
        PID:2400
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8FFCC59B-82B5-4196-A105-824AA9D64F19}
        3⤵
        • Executes dropped EXE
        PID:452
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5823A7D-9C35-4E47-B6B5-285F5B66F69C}
        3⤵
        • Executes dropped EXE
        PID:2668
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8030A387-14CF-490C-9785-D404540F052F}
        3⤵
        • Executes dropped EXE
        PID:1992
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B27D7EA9-7BF9-4CCF-A793-2B91CAC96ABA}
        3⤵
        • Executes dropped EXE
        PID:964
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C118B179-B1EE-44AC-91AF-C181A0D22FB9}
        3⤵
        • Executes dropped EXE
        PID:3552
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7206310-3076-4B49-8D63-C98CDF469D17}
        3⤵
        • Executes dropped EXE
        PID:3728
      • C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
        C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{547F7E6F-ABC3-4BF4-B5C8-5120C6653DCE}
        3⤵
        • Executes dropped EXE
        PID:468
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:928
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:888
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:756
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2008
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3568
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4332
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5080
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0EDE5152-80F7-4AFA-B925-E78A653E50F4}
        3⤵
        • Executes dropped EXE
        PID:1688
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E9AB144-3D8D-4D89-A66A-181D270B1168}
        3⤵
        • Executes dropped EXE
        PID:1796
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7D36C02E-5BFD-4C29-8AE1-6630926C8332}
        3⤵
        • Executes dropped EXE
        PID:4184
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DEBBFD7-9F11-4F0B-AB25-F420DD38C99D}
        3⤵
        • Executes dropped EXE
        PID:1128
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE7DA2CD-787B-4509-8673-D803FDCDBDC4}
        3⤵
        • Executes dropped EXE
        PID:4844
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21338E63-7EAA-4709-8339-462273363F94}
        3⤵
        • Executes dropped EXE
        PID:3276
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2710028-D713-41D6-BF0D-FF17A00B90C2}
        3⤵
        • Executes dropped EXE
        PID:1748
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C6B4C0A5-DADF-4772-823C-D78F0E2FCD02}
        3⤵
        • Executes dropped EXE
        PID:3436
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5F7BC08-E5DA-445C-A846-2722593A4005}
        3⤵
        • Executes dropped EXE
        PID:756
      • C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe
        C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\_is848E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{53778777-CB23-45CF-A863-FC89EB174B3B}
        3⤵
        • Executes dropped EXE
        PID:1712
      • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
        C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D75A6F89-44BF-47EB-B44B-DC9E18E507C4}
        3⤵
          PID:1224
        • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
          C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E74380A9-6960-4B29-9284-F3240052D0B9}
          3⤵
            PID:1540
          • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
            C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D3C1C7B-1FB8-447A-850A-600BA71DE9C8}
            3⤵
              PID:2096
            • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
              C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8487C25E-6BCA-435F-AC2E-4954A64A896C}
              3⤵
                PID:3676
              • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E82B2A79-6576-4282-825F-7A08371E95FF}
                3⤵
                  PID:4184
                • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                  C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F185FA1-4F99-4EE4-85E5-7EF9A4B089AA}
                  3⤵
                    PID:1952
                  • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                    C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7CC0DE26-9026-4F6D-BC59-D877D86E168F}
                    3⤵
                      PID:3444
                    • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                      C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D898AF0F-5836-4BE1-B13A-C56928EA4839}
                      3⤵
                        PID:1704
                      • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                        C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07E71705-7C43-47D9-BE46-B91FE89DD47B}
                        3⤵
                          PID:5004
                        • C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe
                          C:\Users\Admin\AppData\Local\Temp\{680C931B-3C39-4880-8AFA-1FCDF0A79659}\_isE23F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B575106B-BB6D-4E7D-B925-6FBA7E8E8696}
                          3⤵
                            PID:3468
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 874020075643C8D7FA65A341B08D250E E Global\MSI0000
                          2⤵
                          • Badlisted process makes network request
                          • Drops file in System32 directory
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3116
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B19A49CA-B3F8-4BC9-A741-4543B237247B}
                            3⤵
                            • Executes dropped EXE
                            PID:1848
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C40B831-374F-49F7-AEFE-D7F13039D12F}
                            3⤵
                            • Executes dropped EXE
                            PID:764
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65CEB067-019B-4C61-9D51-82F6297FAD6F}
                            3⤵
                            • Executes dropped EXE
                            PID:4336
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C2ED6078-0D79-4A58-9979-CE157F19E232}
                            3⤵
                            • Executes dropped EXE
                            PID:4008
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9273318E-300A-4FB1-A1A0-F04D2A3D2D16}
                            3⤵
                            • Executes dropped EXE
                            PID:1948
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB09ED8A-3562-4583-AA1C-431EEDC20C21}
                            3⤵
                            • Executes dropped EXE
                            PID:5052
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7335E6ED-66D4-4375-B227-0F5634CABDE5}
                            3⤵
                            • Executes dropped EXE
                            PID:2016
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82F54BEF-74CE-4AAC-BFE2-296F4CED595C}
                            3⤵
                            • Executes dropped EXE
                            PID:4216
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F497586-B278-465B-9FA8-4F65597E0BED}
                            3⤵
                            • Executes dropped EXE
                            PID:748
                          • C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe
                            C:\Users\Admin\AppData\Local\Temp\{1BDDF109-7714-4DA7-82A1-8BD49A791EDB}\_isA6BB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF29AED3-D9CA-4579-BE91-438455238DC8}
                            3⤵
                            • Executes dropped EXE
                            PID:4896
                          • C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe
                            C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe /P USERSESSIONID
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4416
                          • C:\Windows\SysWOW64\regedit.exe
                            regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Runs .reg file with regedit
                            PID:4492
                          • C:\Windows\SysWOW64\reg.exe
                            reg.exe import "C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\CredProvider_Inst.reg" /reg:64
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            PID:3188
                          • C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe
                            C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe /P ST_EVENT
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious use of WriteProcessMemory
                            PID:2636
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\sysnative\cmd.exe" /C wevtutil.exe um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                              4⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1772
                              • C:\Windows\system32\wevtutil.exe
                                wevtutil.exe um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                                5⤵
                                  PID:4664
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\sysnative\cmd.exe" /C wevtutil.exe im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                                4⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:4852
                                • C:\Windows\system32\wevtutil.exe
                                  wevtutil.exe im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                                  5⤵
                                    PID:1416
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4224
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33F973F0-7BDA-4269-80B6-A84A18681D96}
                                3⤵
                                • Executes dropped EXE
                                PID:5080
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E6997F0-400A-46D8-87F1-CF2651BAB9F3}
                                3⤵
                                • Executes dropped EXE
                                PID:4232
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC46AA6A-64D1-49B3-933B-63E407AF5816}
                                3⤵
                                • Executes dropped EXE
                                PID:3464
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9B840CDC-BE3F-4BA0-B9DD-50884EFE67A4}
                                3⤵
                                • Executes dropped EXE
                                PID:2096
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A77496F-5077-4679-ADA8-B6328917688C}
                                3⤵
                                • Executes dropped EXE
                                PID:3600
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{917F4CF0-F502-4B2F-909A-5B64A80CDE33}
                                3⤵
                                • Executes dropped EXE
                                PID:4664
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59C58EEB-80E6-470B-AC07-383840AA5E07}
                                3⤵
                                • Executes dropped EXE
                                PID:4856
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5134A051-D3A2-48F5-A622-E369028EB3F9}
                                3⤵
                                • Executes dropped EXE
                                PID:1872
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46CDEBC6-B819-4FB9-875E-AF22B7D0380E}
                                3⤵
                                • Executes dropped EXE
                                PID:2856
                              • C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe
                                C:\Users\Admin\AppData\Local\Temp\{6ABBA29E-A728-4D1C-B8EB-A9A232883A6D}\_isC512.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{534A13C3-1FCF-47FF-878D-810C90959E48}
                                3⤵
                                • Executes dropped EXE
                                PID:3840
                              • C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SSU_Clean.exe
                                C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SSU_Clean.exe /S
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2192
                              • C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\Splashtop_Software_Updater.exe
                                C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\Splashtop_Software_Updater.exe /S /Caller=SVR
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:3808
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A9BB8A6-B311-43C1-8DDE-E2209C312001}
                                3⤵
                                • Executes dropped EXE
                                PID:2536
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6264ABD9-E4C1-4F4A-9A2A-595511E70670}
                                3⤵
                                • Executes dropped EXE
                                PID:4972
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52E54C91-717F-4839-935E-33E26642FC30}
                                3⤵
                                • Executes dropped EXE
                                PID:2156
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4D63888-335A-4541-A0FA-2C91423309E4}
                                3⤵
                                • Executes dropped EXE
                                PID:2120
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{20F79DC4-39D7-44CC-98C2-A1E8E28A2279}
                                3⤵
                                • Executes dropped EXE
                                PID:4944
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58410A1E-D533-4C9E-9D46-2F51012ED5AE}
                                3⤵
                                • Executes dropped EXE
                                PID:1992
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14E07E81-E7F1-4B1A-8F27-611A6AF376FC}
                                3⤵
                                • Executes dropped EXE
                                PID:4856
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{87F17B33-E71F-4CE3-BE5D-538AE9F31642}
                                3⤵
                                • Executes dropped EXE
                                PID:1872
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A807E14-C858-4D14-A15B-00F88C2ACAF7}
                                3⤵
                                • Executes dropped EXE
                                PID:2856
                              • C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe
                                C:\Users\Admin\AppData\Local\Temp\{FAEC15F1-91A6-4B57-B031-104052F80831}\_isD909.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{88FA071B-EFEE-41F8-A5B3-5D31E08092AC}
                                3⤵
                                • Executes dropped EXE
                                PID:1988
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:4760
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FF7EA92-1197-4F36-9EE7-44440347E7FF}
                                3⤵
                                • Executes dropped EXE
                                PID:3160
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{246F502C-9614-4556-9DA0-8D07DAC382AA}
                                3⤵
                                • Executes dropped EXE
                                PID:2628
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{08749701-3F5B-4C30-9B7C-16F309F41831}
                                3⤵
                                • Executes dropped EXE
                                PID:4664
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B46BC11-766B-464A-96B4-1A45AFC787F5}
                                3⤵
                                • Executes dropped EXE
                                PID:620
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8AEEB79-374B-4FBA-B9C1-B07DAFA6822F}
                                3⤵
                                • Executes dropped EXE
                                PID:2988
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{47804DE7-B099-4CB1-B177-8BFF6FA891CC}
                                3⤵
                                • Executes dropped EXE
                                PID:4972
                              • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B76768C9-D308-4483-B64D-E1C88FE17813}
                                3⤵
                                  PID:2156
                                • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                  C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{113AA2E0-8425-405D-9625-3E862D602029}
                                  3⤵
                                    PID:2120
                                  • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                    C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B096326-021D-4C09-9266-AC0895629AAF}
                                    3⤵
                                      PID:4808
                                    • C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe
                                      C:\Users\Admin\AppData\Local\Temp\{A5361F07-3BE8-4AC3-94E6-31FE5C36CA82}\_isDD11.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ECB8892E-E328-49A5-8915-47D29F5F813D}
                                      3⤵
                                        PID:4712
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2516
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5072
                                  • C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1036
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:756
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3260
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                      2⤵
                                      • Sets service image path in registry
                                      • Drops file in System32 directory
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies data under HKEY_USERS
                                      • Modifies system certificate store
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2404
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                        -s
                                        3⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2436
                                        • C:\Windows\SysWOW64\dxdiag.exe
                                          dxdiag.exe /dontskip /t C:\Users\Admin\AppData\Local\Temp\VLvTWe5QJkIk.log
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:1780
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                        3⤵
                                        • Drops file in Program Files directory
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1688
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2864
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                        3⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2052
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDetect.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDetect.exe"
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5004
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                          SRUtility.exe -r
                                          4⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:4236

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        1
                                        T1059

                                        Windows Command Shell

                                        1
                                        T1059.003

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Defense Evasion

                                        Modify Registry

                                        2
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Credential Access

                                        Discovery

                                        Peripheral Device Discovery

                                        2
                                        T1120

                                        Query Registry

                                        4
                                        T1012

                                        System Information Discovery

                                        4
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        e586688.rbs
                                        • Path C:\Config.Msi\e586688.rbs
                                        • Size 72KB
                                        • SHA256 7e4dcc8758c18e0dc6ccaadab771a515b451d1c22ed7aedf8e7f33f82cf1246e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        e58668a.rbs
                                        • Path C:\Config.Msi\e58668a.rbs
                                        • Size 480B
                                        • SHA256 543920776d147ffb46a00855aefd5fe98eebbabf44ec712cb32641da5364fb9a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        DIFxCmd.exe
                                        • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                        • Size 9KB
                                        • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        DIFxCmd64.exe
                                        • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                        • Size 10KB
                                        • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        devcon.exe
                                        • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                        • Size 76KB
                                        • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        devcon64.exe
                                        • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                        • Size 80KB
                                        • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SRAgent.sqlite3
                                        • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                        • Size 72KB
                                        • SHA256 17efe8cdb4eb0003733e0b268c1841bd89bb68ef29a6b9f13c6adfcc10f42674
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                        • Size 727B
                                        • SHA256 1ed775f10ddfe1103ed437588f6b1d535841944eeb102131bf4ea024018a8ce4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                        • Size 412B
                                        • SHA256 aa75eeb3881483739d476dee286a306c6e46138cb0abc67ad48bee24c9bb619a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        PreVer.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\PreVer.log
                                        • Size 2KB
                                        • SHA256 02a2637d59efbf5ecc04818e6a5619f3e29c2b1c03b46f69cbb46f944fbc04f0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        PreVer.log.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\PreVer.log.txt
                                        • Size 2KB
                                        • SHA256 2804c29798b63748250a1e8505e2d37625c3e66aab95021573d1e3afb4a6e40a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        System.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nseCF72.tmp\System.dll
                                        • Size 11KB
                                        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        unpack.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack.log
                                        • Size 3KB
                                        • SHA256 8a05bcba1344541547b869cbaa20313fd76ad9bcc4ff9f4b008320dcc78259ef
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        unpack.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack.log
                                        • Size 4KB
                                        • SHA256 a29e5b61dfb15377ce28e31e40a53e66443c8db7f615cc1d03bf8950a5a08544
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        PreVerCheck.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack\PreVerCheck.exe
                                        • Size 1.7MB
                                        • SHA256 ceaf2cebfc104d1e31851880148f5b141e8909dce0381b7eee608c01088c188b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        run.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack\run.bat
                                        • Size 15B
                                        • SHA256 a6212daaa9a377b202a9436d80ab97bc9b0050dc7e174fcd35f255b34500cfab
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        setup.ini
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack\setup.ini
                                        • Size 1KB
                                        • SHA256 09752bf6c786476044f0df4c0547313e6b62fe86a4511a1e2af5f64241bdf737
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        setup.msi
                                        • Path C:\Users\Admin\AppData\Local\Temp\unpack\setup.msi
                                        • Size 35.2MB
                                        • SHA256 9deb0eebd2c1187401600e654fb4a581482c9aee2d44269b751d2e147c96d989
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        InstRegExp.reg
                                        • Path C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg
                                        • Size 149B
                                        • SHA256 163b08a2538ca105940c7a8f6c67288b3c533368e49c3e817afc67e925ffad17
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        SetupUtil.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe
                                        • Size 1.4MB
                                        • SHA256 00e7e75e33b40c859fd82407f88a6ed0e7a25b63053823fa7e1b7ca5088e8838
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ISRT.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\ISRT.dll
                                        • Size 427KB
                                        • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _is71EF.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_is71EF.exe
                                        • Size 179KB
                                        • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _isres_0x0409.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\{BC9030A5-8BFB-49F6-9434-2B3D89745FBF}\_isres_0x0409.dll
                                        • Size 1.8MB
                                        • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        IsConfig.ini
                                        • Path C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\IsConfig.ini
                                        • Size 538B
                                        • SHA256 47c62829e64985b67240e756c8d15f8993ea9b561a55c0f72e2b35aef08aab6f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        String1033.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\String1033.txt
                                        • Size 181KB
                                        • SHA256 35a7e6b93e37d95e3f933ed9ed2bffdd062dac82556af7e5c27c04c245c78414
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        setup.inx
                                        • Path C:\Users\Admin\AppData\Local\Temp\{CDCD836E-7648-422D-B7BD-2D4402C49492}\setup.inx
                                        • Size 343KB
                                        • SHA256 84d7ac41e9cff5839f94c0a063f0671fe09eab171652bc9eb69dad9346314947
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MSI6C23.tmp
                                        • Path C:\Windows\Installer\MSI6C23.tmp
                                        • Size 173KB
                                        • SHA256 5a36c709648e40ec1224855fb77e7420ee53e267c185f31c2c016115fba4af38
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MSI6DF8.tmp
                                        • Path C:\Windows\Installer\MSI6DF8.tmp
                                        • Size 167KB
                                        • SHA256 8041d3ccbafa491d35f70030c3afeba683b0235bed24f242878d04c7e87b8687
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MSI6F22.tmp
                                        • Path C:\Windows\Installer\MSI6F22.tmp
                                        • Size 4.5MB
                                        • SHA256 eee88a16ddcadc64dcf5f3f0257917648662ede70625a76ca80dd5813174ca97
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        metadata-2
                                        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                        • Size 24.1MB
                                        • SHA256 ba63b8da4b7d78b744c5aaac395f25cb2389e3a240b33e0fbc82545dc694ca75
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        {57df16db-e14c-4f08-883e-c62f04775c4d}_OnDiskSnapshotProp
                                        • Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{57df16db-e14c-4f08-883e-c62f04775c4d}_OnDiskSnapshotProp
                                        • Size 6KB
                                        • SHA256 41096ca17b98bdbfec843edbb1a05677d78d121f8a85262357f74db96f0c0902
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/2404-794-0x00000000037A0000-0x00000000037F0000-memory.dmp
                                        Download

                                        memory/2404-788-0x0000000002D60000-0x0000000002DB0000-memory.dmp
                                        Download

                                        memory/2436-758-0x0000000000F30000-0x0000000000F88000-memory.dmp
                                        Download

                                        memory/2436-760-0x0000000002AA0000-0x0000000002AF0000-memory.dmp
                                        Download

                                        memory/3116-673-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/3116-621-0x0000000003560000-0x00000000035B0000-memory.dmp
                                        Download

                                        memory/3116-646-0x0000000003560000-0x0000000003727000-memory.dmp
                                        Download

                                        memory/3116-522-0x0000000003300000-0x00000000034C7000-memory.dmp
                                        Download

                                        memory/3116-604-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/3116-596-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/3116-517-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/4632-157-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/4632-117-0x0000000003FA0000-0x0000000004167000-memory.dmp
                                        Download

                                        memory/4632-725-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download

                                        memory/4632-728-0x0000000003FC0000-0x0000000004187000-memory.dmp
                                        Download

                                        memory/4632-162-0x0000000003FB0000-0x0000000004177000-memory.dmp
                                        Download

                                        memory/4632-112-0x0000000010000000-0x0000000010114000-memory.dmp
                                        Download