phemedrone | 6ac30aaef20c25564eebdbfd55db25f61ff6c84204ecc30241c0cf2332a0d04b

General

Target

WaveInstaller.exe
Size

2.3MB
MD5

f80723c7062d0414bfd23249a943b330
SHA1

0996049a3da01ef925e954867aaa302d82279639
SHA256

6ac30aaef20c25564eebdbfd55db25f61ff6c84204ecc30241c0cf2332a0d04b
SHA512

f99821c40a3c1d19403b7cd21a2434293d2d23c92a716312e4bbbfb433b1c4b2ec4c90ce9750d4b574d0a802108191621a3b018ab2ebff65f535d843929278de
SSDEEP

49152:XJAFOSG/TBqwnbetRXZRAL3Wa88eVuN6yCQhJolninbT:ZAo3/T5bQRpRAL3denin

Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:19121

goods-flex.gl.at.ply.gg:19121

Attributes

Install_directory
%Public%
install_file
calc.exe

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\calcc.exe	family_xworm
behavioral1/memory/2260-21-0x0000000000A40000-0x0000000000A58000-memory.dmp	family_xworm
behavioral1/memory/1680-271-0x0000000000300000-0x0000000000318000-memory.dmp	family_xworm
behavioral1/memory/2096-465-0x0000000000330000-0x0000000000348000-memory.dmp	family_xworm

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2652	powershell.exe
2564	powershell.exe
1476	powershell.exe
2852	powershell.exe
2604	powershell.exe
2108	powershell.exe
1636	powershell.exe
1720	powershell.exe
1060	powershell.exe
2104	powershell.exe
2024	powershell.exe
2688	powershell.exe
2444	powershell.exe
3028	powershell.exe
1668	powershell.exe
2404	powershell.exe
1592	powershell.exe
2700	powershell.exe
2076	powershell.exe
2464	powershell.exe
1076	powershell.exe
2784	powershell.exe
2408	powershell.exe
2972	powershell.exe
2920	powershell.exe
2780	powershell.exe
2748	powershell.exe
3020	powershell.exe
796	powershell.exe
2096	powershell.exe
2804	powershell.exe
2752	powershell.exe
2396	powershell.exe
1592	powershell.exe
2204	powershell.exe
2128	powershell.exe
2028	powershell.exe
2716	powershell.exe
1104	powershell.exe
2840	powershell.exe
2888	powershell.exe
2008	powershell.exe
1916	powershell.exe
2692	powershell.exe
2988	powershell.exe
1664	powershell.exe
1780	powershell.exe
580	powershell.exe
2684	powershell.exe
484	powershell.exe
2564	powershell.exe
2668	powershell.exe
2836	powershell.exe
1700	powershell.exe
2100	powershell.exe
2820	powershell.exe
2884	powershell.exe
1744	powershell.exe
796	powershell.exe
2640	powershell.exe
1588	powershell.exe
2036	powershell.exe
2240	powershell.exe
2964	powershell.exe

Drops startup file 2 IoCs

Processes:

calcc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc.lnk	calcc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc.lnk	calcc.exe

Executes dropped EXE 64 IoCs

Processes:

calcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalc.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalcc.exeSync Center.execalc.exe

pid	process
2260	calcc.exe
2532	Sync Center.exe
2972	calcc.exe
1596	Sync Center.exe
2008	calcc.exe
2572	Sync Center.exe
2900	calcc.exe
2952	Sync Center.exe
1688	calcc.exe
2248	Sync Center.exe
448	calcc.exe
2912	Sync Center.exe
1396	calcc.exe
1544	Sync Center.exe
2820	calcc.exe
1492	Sync Center.exe
660	calcc.exe
444	Sync Center.exe
2104	calcc.exe
2292	Sync Center.exe
1980	calcc.exe
744	Sync Center.exe
2444	calcc.exe
2928	Sync Center.exe
2220	calcc.exe
1572	Sync Center.exe
2464	calcc.exe
2804	Sync Center.exe
2116	calcc.exe
2720	Sync Center.exe
1680	calc.exe
2576	calcc.exe
2980	Sync Center.exe
2348	calcc.exe
316	Sync Center.exe
1916	calcc.exe
3068	Sync Center.exe
1896	calcc.exe
2712	Sync Center.exe
1584	calcc.exe
624	Sync Center.exe
612	calcc.exe
2588	Sync Center.exe
2096	calcc.exe
1260	Sync Center.exe
2568	calcc.exe
2272	Sync Center.exe
1812	calcc.exe
3008	Sync Center.exe
1544	calcc.exe
2072	Sync Center.exe
2916	calcc.exe
2956	Sync Center.exe
2784	calcc.exe
1196	Sync Center.exe
640	calcc.exe
2788	Sync Center.exe
1952	calcc.exe
1980	Sync Center.exe
2892	calcc.exe
1072	Sync Center.exe
1628	calcc.exe
2004	Sync Center.exe
2096	calc.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.execalcc.exeWaveInstaller.exeWaveInstaller.exeWaveInstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calc = "C:\\Users\\Public\\calc.exe"	calcc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\calcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\calcc.exe"	WaveInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sync Center = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sync Center.exe"	WaveInstaller.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 ip-api.com
2 ip-api.com
30 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2896 schtasks.exe

flow	ioc
51	ip-api.com
2	ip-api.com
30	ip-api.com

pid	process
2896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exepowershell.exeSync Center.exe

pid	process
2688	powershell.exe
2692	powershell.exe
1700	powershell.exe
2532	Sync Center.exe
580	powershell.exe
484	powershell.exe
2920	powershell.exe
1596	Sync Center.exe
1260	powershell.exe
1744	powershell.exe
1064	powershell.exe
2096	powershell.exe
1588	powershell.exe
2572	Sync Center.exe
2564	powershell.exe
1696	powershell.exe
2784	powershell.exe
580	powershell.exe
2264	powershell.exe
2952	Sync Center.exe
1652	powershell.exe
2036	powershell.exe
2016	powershell.exe
2248	Sync Center.exe
2668	powershell.exe
1060	powershell.exe
2128	powershell.exe
2912	Sync Center.exe
2652	powershell.exe
2988	powershell.exe
1592	powershell.exe
1544	Sync Center.exe
1572	powershell.exe
1324	powershell.exe
1552	powershell.exe
1492	Sync Center.exe
2804	powershell.exe
796	powershell.exe
1756	powershell.exe
444	Sync Center.exe
2356	powershell.exe
2616	powershell.exe
2836	powershell.exe
2292	Sync Center.exe
1528	powershell.exe
2780	powershell.exe
2028	powershell.exe
744	Sync Center.exe
2256	powershell.exe
2128	powershell.exe
2752	powershell.exe
2928	Sync Center.exe
2748	powershell.exe
1664	powershell.exe
2640	powershell.exe
1572	Sync Center.exe
1528	powershell.exe
2408	powershell.exe
2480	powershell.exe
2804	Sync Center.exe
2888	powershell.exe
2128	powershell.exe
2036	powershell.exe
2720	Sync Center.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.exepowershell.execalcc.exepowershell.exepowershell.exeSync Center.exepowershell.exepowershell.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exeSync Center.exeWaveInstaller.exepowershell.exepowershell.execalcc.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3016	WaveInstaller.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2260	calcc.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2532	Sync Center.exe
Token: SeDebugPrivilege	2728	WaveInstaller.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	2972	calcc.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	1596	Sync Center.exe
Token: SeDebugPrivilege	768	WaveInstaller.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	2008	calcc.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2572	Sync Center.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1944	WaveInstaller.exe
Token: SeDebugPrivilege	2260	calcc.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	2900	calcc.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2952	Sync Center.exe
Token: SeDebugPrivilege	2448	WaveInstaller.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1688	calcc.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2248	Sync Center.exe
Token: SeDebugPrivilege	1940	WaveInstaller.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	448	calcc.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2912	Sync Center.exe
Token: SeDebugPrivilege	1248	WaveInstaller.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	1396	calcc.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1544	Sync Center.exe
Token: SeDebugPrivilege	2076	WaveInstaller.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	2820	calcc.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1492	Sync Center.exe
Token: SeDebugPrivilege	2024	WaveInstaller.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	660	calcc.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	444	Sync Center.exe
Token: SeDebugPrivilege	1060	WaveInstaller.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2104	calcc.exe
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WaveInstaller.exeWaveInstaller.exeSync Center.exeWaveInstaller.execalcc.exe

description	pid	process	target process
PID 3016 wrote to memory of 2688	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2688	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2688	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2728	3016	WaveInstaller.exe	WaveInstaller.exe
PID 3016 wrote to memory of 2728	3016	WaveInstaller.exe	WaveInstaller.exe
PID 3016 wrote to memory of 2728	3016	WaveInstaller.exe	WaveInstaller.exe
PID 3016 wrote to memory of 2692	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2692	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2692	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2260	3016	WaveInstaller.exe	calcc.exe
PID 3016 wrote to memory of 2260	3016	WaveInstaller.exe	calcc.exe
PID 3016 wrote to memory of 2260	3016	WaveInstaller.exe	calcc.exe
PID 3016 wrote to memory of 1700	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 1700	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 1700	3016	WaveInstaller.exe	powershell.exe
PID 3016 wrote to memory of 2532	3016	WaveInstaller.exe	Sync Center.exe
PID 3016 wrote to memory of 2532	3016	WaveInstaller.exe	Sync Center.exe
PID 3016 wrote to memory of 2532	3016	WaveInstaller.exe	Sync Center.exe
PID 2728 wrote to memory of 580	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 580	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 580	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 768	2728	WaveInstaller.exe	WaveInstaller.exe
PID 2728 wrote to memory of 768	2728	WaveInstaller.exe	WaveInstaller.exe
PID 2728 wrote to memory of 768	2728	WaveInstaller.exe	WaveInstaller.exe
PID 2728 wrote to memory of 484	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 484	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 484	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 2972	2728	WaveInstaller.exe	calcc.exe
PID 2728 wrote to memory of 2972	2728	WaveInstaller.exe	calcc.exe
PID 2728 wrote to memory of 2972	2728	WaveInstaller.exe	calcc.exe
PID 2728 wrote to memory of 2920	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 2920	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 2920	2728	WaveInstaller.exe	powershell.exe
PID 2728 wrote to memory of 1596	2728	WaveInstaller.exe	Sync Center.exe
PID 2728 wrote to memory of 1596	2728	WaveInstaller.exe	Sync Center.exe
PID 2728 wrote to memory of 1596	2728	WaveInstaller.exe	Sync Center.exe
PID 2532 wrote to memory of 1644	2532	Sync Center.exe	WerFault.exe
PID 2532 wrote to memory of 1644	2532	Sync Center.exe	WerFault.exe
PID 2532 wrote to memory of 1644	2532	Sync Center.exe	WerFault.exe
PID 768 wrote to memory of 1260	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 1260	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 1260	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 1944	768	WaveInstaller.exe	WaveInstaller.exe
PID 768 wrote to memory of 1944	768	WaveInstaller.exe	WaveInstaller.exe
PID 768 wrote to memory of 1944	768	WaveInstaller.exe	WaveInstaller.exe
PID 768 wrote to memory of 1744	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 1744	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 1744	768	WaveInstaller.exe	powershell.exe
PID 2260 wrote to memory of 1064	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 1064	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 1064	2260	calcc.exe	powershell.exe
PID 768 wrote to memory of 2008	768	WaveInstaller.exe	calcc.exe
PID 768 wrote to memory of 2008	768	WaveInstaller.exe	calcc.exe
PID 768 wrote to memory of 2008	768	WaveInstaller.exe	calcc.exe
PID 768 wrote to memory of 2096	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 2096	768	WaveInstaller.exe	powershell.exe
PID 768 wrote to memory of 2096	768	WaveInstaller.exe	powershell.exe
PID 2260 wrote to memory of 1588	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 1588	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 1588	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 2564	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 2564	2260	calcc.exe	powershell.exe
PID 2260 wrote to memory of 2564	2260	calcc.exe	powershell.exe
PID 768 wrote to memory of 2572	768	WaveInstaller.exe	Sync Center.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        5⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        6⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        7⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        8⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        9⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        10⤵
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        11⤵
        Adds Run key to start application
        
        PID:2552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        12⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        12⤵
        Adds Run key to start application
        
        PID:2172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        13⤵
        Adds Run key to start application
        
        PID:2884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        14⤵
        Adds Run key to start application
        
        PID:2396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        15⤵
        Adds Run key to start application
        
        PID:2972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        16⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        16⤵
        Adds Run key to start application
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        17⤵
        Adds Run key to start application
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        18⤵
        Adds Run key to start application
        
        PID:1676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        19⤵
        Adds Run key to start application
        
        PID:2524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        20⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        20⤵
        Adds Run key to start application
        
        PID:2272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        21⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        21⤵
        Adds Run key to start application
        
        PID:592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        22⤵
        Adds Run key to start application
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        23⤵
        Adds Run key to start application
        
        PID:1760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        24⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        24⤵
        Adds Run key to start application
        
        PID:3032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        25⤵
        Adds Run key to start application
        
        PID:1692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        26⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        26⤵
        Adds Run key to start application
        
        PID:304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        27⤵
        Adds Run key to start application
        
        PID:2268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        28⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        28⤵
        Adds Run key to start application
        
        PID:1948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        29⤵
        Adds Run key to start application
        
        PID:2356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        30⤵
        Adds Run key to start application
        
        PID:2392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        31⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        31⤵
        Adds Run key to start application
        
        PID:2864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        32⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        32⤵
        Adds Run key to start application
        
        PID:2040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        33⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        33⤵
        Adds Run key to start application
        
        PID:2656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        34⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        34⤵
        Adds Run key to start application
        
        PID:2920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        35⤵
        Adds Run key to start application
        
        PID:1944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        36⤵
        Adds Run key to start application
        
        PID:2640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        37⤵
        Adds Run key to start application
        
        PID:2140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
        38⤵
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        38⤵
        
        PID:2084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        38⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        38⤵
        
        PID:2372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        37⤵
        
        PID:2896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        37⤵
        
        PID:2552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        36⤵
        
        PID:2908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        36⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        36⤵
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        35⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        35⤵
        
        PID:2296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        35⤵
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        34⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        34⤵
        
        PID:1068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        34⤵
        
        PID:1696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        33⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        33⤵
        
        PID:1920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        33⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        33⤵
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        32⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        32⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        32⤵
        Executes dropped EXE
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        31⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        31⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        31⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        31⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        30⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        30⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        29⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        29⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        29⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        28⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        28⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        28⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        27⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        27⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        27⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        26⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        26⤵
        Executes dropped EXE
        
        PID:1544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        26⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        25⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        25⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        25⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        24⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        24⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        24⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        24⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        23⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        23⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        23⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        23⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        22⤵
        Executes dropped EXE
        
        PID:612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        22⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        21⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        21⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        21⤵
        Executes dropped EXE
        
        PID:624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        20⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        20⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        19⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        19⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        18⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        18⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        18⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        18⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        17⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        17⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        17⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        16⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        16⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        16⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        15⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        15⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        14⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        13⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        12⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\calcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\calcc.exe
      "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:484
- - C:\Users\Admin\AppData\Local\Temp\calcc.exe
    "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
    "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\calcc.exe
  "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'calcc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\calc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'calc.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "calc" /tr "C:\Users\Public\calc.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
  "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2532 -s 640
    3⤵
    PID:1644

C:\Windows\system32\taskeng.exe
taskeng.exe {E0094799-21C9-4AA2-949D-CD6A3ED200B1} S-1-5-21-2257386474-3982792636-3902186748-1000:CTBHAMHL\Admin:Interactive:[1]
1⤵
PID:2764
- C:\Users\Public\calc.exe
  C:\Users\Public\calc.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Users\Public\calc.exe
  C:\Users\Public\calc.exe
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Sync Center.exe

Filesize
121KB

MD5
7b6c19c2c8fc4ff9cc5b136f22cf490d

SHA1
e557a697a268c54a73aaffd02d25e54c4f601719

SHA256
cf6c9880812d48fe7ba3a1d1a1692a881745a7fb8cf6534f94555dd7dd1c3353

SHA512
afe23d16011e1eb71ce3be9f8796cf0398cc9e01415c93cd4e8403f1ee84f48e23396ab7709b60d5a9e5b3e5daee9e8f90bae99e6a85ece6475fa8bdd82f953b

Download Submit
C:\Users\Admin\AppData\Local\Temp\calcc.exe

Filesize
71KB

MD5
36686a659c023c60d85630ef9080ee34

SHA1
c26facc03073d700fc65af33eb2d8a6215f065b6

SHA256
eadd6fd65960900c14dd8e18a16348ec4c6f766e6316428f8cf659d02b43fb49

SHA512
236eab23ae8a565532ffd063a7e31ecc9aa835c63ca243c15ddba652f639dc5249589340812299e523156ac8695571877d1af78c2a481f0b2527d90aa00c3587

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
dedff30cbb6f17542b034097f2532cc2

SHA1
420a974174c304453767f75d8fc9214d0bfc7798

SHA256
76b6f4131e116d82601db7eac77eca5a3c1d5b4fdd5d7eb889f1566b0b1d11c7

SHA512
3ad5d729ac042ea16adbd04ea34eff12d120d7bfbb1f8898cf83a624ca2f50709102df144db3d187d42a677e2641e06725f814d45e95c9fd65668a8796ea34ab

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1680-271-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/2096-465-0x0000000000330000-0x0000000000348000-memory.dmp

Filesize
96KB

Download
memory/2260-21-0x0000000000A40000-0x0000000000A58000-memory.dmp

Filesize
96KB

Download
memory/2532-32-0x00000000002E0000-0x0000000000304000-memory.dmp

Filesize
144KB

Download
memory/2688-8-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2688-7-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2692-15-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2692-14-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/3016-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/3016-33-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-1-0x0000000001030000-0x0000000001290000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads