Overview

overview

10

Static

static

3

launcher.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    182s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2024 16:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    launcher.exe

  • Size

    296KB

  • MD5

    7c43de969f5117062f9e2aff9c32b5c8

  • SHA1

    5887cd36102f856abf27e885c3c10e78ca8032a4

  • SHA256

    1c742cf055297ced1f29fa5779cfa2c9c53fc64d945d6edd7330beb5f0d88a72

  • SHA512

    30004800e2b002e4b1f1c6bbdc4fc8a00d5f56ddb859b1047fcce63dd14ca51cc3ef9d7599b440b9795e3587b6af333728d75bd37ae5004ef3189f530ef6eebd

  • SSDEEP

    6144:clGtyUXasfHznB3XjdOwkL1xOh9XLpf6TUIa1bq/KMw:cJUXBB3zEjLPUf6J

Score
10/10
phemedronexwormcredential_accessexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:19121

goods-flex.gl.at.ply.gg:19121
Attributes
  • Install_directory

    %Public%

  • install_file

    calc.exe

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Signatures

  • Detect Xworm Payload 2 IoCs
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Users\Admin\AppData\Local\Temp\launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2716
      • C:\Users\Admin\AppData\Local\Temp\launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3180
        • C:\Users\Admin\AppData\Local\Temp\launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2840
          • C:\Users\Admin\AppData\Local\Temp\launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1752
          • C:\Users\Admin\AppData\Local\Temp\calcc.exe
            "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
            "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:464
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:1584
        • C:\Users\Admin\AppData\Local\Temp\calcc.exe
          "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1304
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4244
        • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
          "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5036
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2884
      • C:\Users\Admin\AppData\Local\Temp\calcc.exe
        "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
        "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\calcc.exe
      "C:\Users\Admin\AppData\Local\Temp\calcc.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\calcc.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4604
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'calcc.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\calc.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'calc.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3280
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "calc" /tr "C:\Users\Public\calc.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sync Center.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3780
    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
      "C:\Users\Admin\AppData\Local\Temp\Sync Center.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4908
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3656
  • C:\Users\Public\calc.exe
    C:\Users\Public\calc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2596
  • C:\Users\Public\calc.exe
    C:\Users\Public\calc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3972
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:856
    • C:\Users\Public\calc.exe
      C:\Users\Public\calc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1560

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    3
    T1552

    Credentials In Files

    3
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\calc.exe.log
      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\launcher.exe.log
      Filesize

      1KB

      MD5

      bb6a89a9355baba2918bb7c32eca1c94

      SHA1

      976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2

      SHA256

      192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b

      SHA512

      efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      9a2c763c5ff40e18e49ad63c7c3b0088

      SHA1

      4b289ea34755323fa869da6ad6480d8d12385a36

      SHA256

      517807921c55bd16cd8a8bfae3d5dc19444c66f836b66acd5593e3080acbaf8e

      SHA512

      3af01926bc7de92076067d158d7250b206d396b3282ee0db43639d04d91bd9ff763acbce12c7822914824984a3c5fdd1b8dbf1ad2ee88233d47f0f808b746bc8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      caae66b2d6030f85188e48e4ea3a9fa6

      SHA1

      108425bd97144fa0f92ff7b2109fec293d14a461

      SHA256

      a6c642eaf80247e9682be60ab5ae9ece4d042af56013d164d8047b6fd1aefa1d

      SHA512

      189119a2390e51a49ea0fb8ad1427279cc2bf85f220f3212957c50b33387623b42ab7736fb5a717757b5c4b99c570e7ed2e5e6a578424aafb5c126cdf129ea15

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      e5172dc19ff9bd48c192860499539699

      SHA1

      c71d468dfe7821a2a9926a64aa9d2354690f8c41

      SHA256

      263688cd2d3145fdc5bf4739300ceac5a5b597109b1c9529b562961759bda815

      SHA512

      c1c71f2e384bffd1513d0ea43952d67561cc2a3fd793969d60e7bd0b13f6889bc24c302f7c943abab30fea8dcc03f0ffb6fe548e81269b0534be16a27891a9c8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      22310ad6749d8cc38284aa616efcd100

      SHA1

      440ef4a0a53bfa7c83fe84326a1dff4326dcb515

      SHA256

      55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

      SHA512

      2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      ef72c47dbfaae0b9b0d09f22ad4afe20

      SHA1

      5357f66ba69b89440b99d4273b74221670129338

      SHA256

      692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

      SHA512

      7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      eb1ad317bd25b55b2bbdce8a28a74a94

      SHA1

      98a3978be4d10d62e7411946474579ee5bdc5ea6

      SHA256

      9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

      SHA512

      d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      f41f42c322498af0591f396c59dd4304

      SHA1

      e1e5aa68d73d48bc5e743a34f6c0fa8960ff7514

      SHA256

      d8bd9a4a363ff2ac2dc887759ec6ba4215a4ce0925a8fb9c531573458ee4a31c

      SHA512

      2328a1b402b4fb0de9c451fb630eab58549129d3bcfb70b9834cfbd16065ebaadec006b309ea17ac182d34c53e01705cbc9e0196eb0cbd62600c866e79a1844f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      da5c82b0e070047f7377042d08093ff4

      SHA1

      89d05987cd60828cca516c5c40c18935c35e8bd3

      SHA256

      77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

      SHA512

      7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      3b444d3f0ddea49d84cc7b3972abe0e6

      SHA1

      0a896b3808e68d5d72c2655621f43b0b2c65ae02

      SHA256

      ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74

      SHA512

      eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      6d42b6da621e8df5674e26b799c8e2aa

      SHA1

      ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

      SHA256

      5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

      SHA512

      53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      bbc2b43d5e574fe7d193c6fc0eb7302c

      SHA1

      f22683b94ad593fd0513fef37df1fb5d0880cc22

      SHA256

      0efa2469ae0b02af024fd0e2828ccab085eaefef3736b3bda0ba631e3a45aa48

      SHA512

      287449b168297a5176b26777f2f5ca3284d967b93274db8b3029d130049073560a10e418607f670d08194193aa91fc9cd174717e7c1d051b09c23857fe3ab9d2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      15dde0683cd1ca19785d7262f554ba93

      SHA1

      d039c577e438546d10ac64837b05da480d06bf69

      SHA256

      d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

      SHA512

      57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Sync Center.exe
      Filesize

      121KB

      MD5

      7b6c19c2c8fc4ff9cc5b136f22cf490d

      SHA1

      e557a697a268c54a73aaffd02d25e54c4f601719

      SHA256

      cf6c9880812d48fe7ba3a1d1a1692a881745a7fb8cf6534f94555dd7dd1c3353

      SHA512

      afe23d16011e1eb71ce3be9f8796cf0398cc9e01415c93cd4e8403f1ee84f48e23396ab7709b60d5a9e5b3e5daee9e8f90bae99e6a85ece6475fa8bdd82f953b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dwmh03yi.10m.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\calcc.exe
      Filesize

      71KB

      MD5

      36686a659c023c60d85630ef9080ee34

      SHA1

      c26facc03073d700fc65af33eb2d8a6215f065b6

      SHA256

      eadd6fd65960900c14dd8e18a16348ec4c6f766e6316428f8cf659d02b43fb49

      SHA512

      236eab23ae8a565532ffd063a7e31ecc9aa835c63ca243c15ddba652f639dc5249589340812299e523156ac8695571877d1af78c2a481f0b2527d90aa00c3587

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc.lnk
      Filesize

      967B

      MD5

      de6b787e4458cfab384c40d687e8b063

      SHA1

      19be39783883a7ff378e90ee5946521865abd452

      SHA256

      9e6f6338c53721c124fcd68420ccdae76d23534db35034148d5cbdd023bcb9ab

      SHA512

      afbe54da3cbcdd79d82ee1f7aae6380cf0fc6e995668dec6045071c5b5a62d7ffbb1d70564859f4228ed8bb7b1744ea56c775f23bea930328caa557584ff2915

      Download Submit

    • memory/464-295-0x000000001AE60000-0x000000001AF62000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1652-23-0x0000017F4D530000-0x0000017F4D552000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3656-10-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-14-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-5-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-11-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-15-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-4-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-13-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-12-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-9-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3656-3-0x0000022F3DF70000-0x0000022F3DF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3876-241-0x000000001C190000-0x000000001C292000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/3876-201-0x000000001C190000-0x000000001C292000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4012-79-0x000000001B5A0000-0x000000001B6A2000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4012-198-0x000000001B5A0000-0x000000001B6A2000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4064-293-0x000000001BC90000-0x000000001BD92000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4112-256-0x000000001BB60000-0x000000001BC62000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4112-291-0x000000001BB60000-0x000000001BC62000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4180-53-0x0000000000550000-0x0000000000568000-memory.dmp

      Filesize

      96KB

      Download

    • memory/4180-80-0x000000001B7D0000-0x000000001B8D2000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4416-17-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4416-0-0x00007FF9B78D3000-0x00007FF9B78D5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4416-16-0x00007FF9B78D3000-0x00007FF9B78D5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4416-2-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4416-78-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4416-1-0x0000000000F50000-0x0000000000FA0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4436-204-0x000000001B040000-0x000000001B142000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4908-81-0x000000001B7D0000-0x000000001B8D2000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4908-77-0x00000000009F0000-0x0000000000A14000-memory.dmp

      Filesize

      144KB

      Download