Overview

overview

10

Static

static

3

Ref2279824...sx.exe

windows7-x64

10

Ref2279824...sx.exe

windows10-2004-x64

10

Resubmissions

30-09-2024 09:01

240930-ky1ggs1dmh 10

30-09-2024 08:44

240930-km6t5azhjh 8

Analysis

  • max time kernel
    318s
  • max time network
    325s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ref227982472 3611316041 有害物情報.Xlsx.exe

  • Size

    644KB

  • MD5

    2055e529b8767f5ebaee9afcefd16d91

  • SHA1

    521d53678fbba3951f19dd2cfed6e4b0d5ef8914

  • SHA256

    550aeabbe62d5a14363bac014c16acb456fd2d92ea227d5762a85a51466e3404

  • SHA512

    e98333277ff85e147feb5efea6f0376bfbb2cd9bfa361337fdc40c5c211c626b8e7728326d40158e423b33f31eec0cdde3314dee8c19aa82042c747e6aaf01a3

  • SSDEEP

    12288:gUxKiiSUMD8mBsdNnyVyPziLeSAkJuf3TBtN:gUxchMAfdgVUziqSAmud3

Score
10/10
snakekeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3008
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:376
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C62.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1752
      2⤵
      • Program crash
      PID:2344
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4548,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    1⤵
      PID:1448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 2244
      1⤵
        PID:4220
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
        1⤵
        • Drops file in System32 directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:2888
      • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
        C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1712
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1228
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1DBD.tmp"
          2⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3076
        • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
          "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          2⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2084
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3672
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2428
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3020
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1876
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5572.tmp"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2312
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook profiles
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • outlook_office_path
              • outlook_win_path
              PID:696
          • C:\Windows\system32\eventvwr.exe
            eventvwr
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3124
            • C:\Windows\system32\mmc.exe
              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
              3⤵
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:5032
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1548
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4956
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:392
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F77.tmp"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2988
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Executes dropped EXE
              PID:4988
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4984
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:864
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2432
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5048
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3514.tmp"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2284
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4196
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3452
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2896
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1048
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4532
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D03.tmp"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1640
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4476
          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            sCWlgOWYFciIYD.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1780
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3740
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3008
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40FB.tmp"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4344
            • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
              "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
              3⤵
                PID:760

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sCWlgOWYFciIYD.exe.log
            Filesize

            1KB

            MD5

            36049bae97bba745c793444373453cb0

            SHA1

            eb6e9a822944e8e207abba1a5e53f0183a1684f1

            SHA256

            839fa1f9725719938ffa24533587b168bae2768f23ac09dccb3ad4ab8ae6abcd

            SHA512

            a6584b7b435afeffb6becfbed82517087030eb23534fa50deecd02330bf36d633ba22e979e36b9c27e35885f9cc1cc9481dadc53cc265be61391e11a7c2c7cdb

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            17KB

            MD5

            b7634c69573635e26bed6977b181f776

            SHA1

            1f315ce5554f973dd9a7b1bc5be94de28e123f4f

            SHA256

            e875e4b05f0f99a78b6a58be57367be6e3d484cd65fbbd9ba9f9ee6f98ca6f8b

            SHA512

            67607f7dafc564d0adc627574ad96502e8aadf223395ee3810f0ed044b714bdf812b50dd9db5d81529edb4139cb7a2644658c148ab8afa1fea2581727ae6c463

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            f5f84382fce3e2f0fb5248b201fb88ef

            SHA1

            8bfd869cfc0be89e9638d9106bc9fdc4de5b551b

            SHA256

            62eb1674b485dd4a5ec2ee5e366b1730a82cb51cac0e0ab01dc4b2412281b0de

            SHA512

            5ecf9a18f28f646c8e71f081d27bcfdd15907027af5e656e6b13553f468c3f10ae770bf2e21d5771fd2dcc25987dd109dd542ea2bc3e86913d44db633a65c6ec

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            cef96b9d5532d74687af90bf6b27ce9b

            SHA1

            b23aa3b2ceded3f0df9934f36f9e748b00ea1879

            SHA256

            45ba5f5ab8c8e2b30769dc1ad6f7991f99db02ea62eb6fadfa7190534aa9ea52

            SHA512

            faed2af8b936fd96fad7eea9746256634a24956ba4f7f47d7a9aa308e30e860e95531cee354872be4c84d5da05ff4c109230ec3f77fb25352724e5d5507a1ae8

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            2a5b2180a4f8cfecf32a4655d58d0dec

            SHA1

            6b2e3f11a06d142ab2f59deaf4ccc6659618265a

            SHA256

            d13f724f27e913c3c61ae7c098bcd4c9b82c229f1277dc4ef0c1631f8531ad10

            SHA512

            a7e3187591db69200db45bbbdfa84ae49265be89bcb89b684b533b8690d89098d8d9c45037f8ffdb23df01710ae0cd82dc3fa477669676936066614c22e7402b

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            31a55101a53461bcfbf47eb4da59c54b

            SHA1

            68731562a4841fcd72d7edda922239ce960f9ce8

            SHA256

            43f1e68075130a45cdf5a83367656211c9c6e7279996b3535457e49d1d274fdf

            SHA512

            fac6cdfb24c8923708ffe47a68efdcc3990a0ba87498fada9742cc3f3631d739cd57e5b2bf6926f661d43e6f9e0b8ae20984841d0c0b67e3ac3bd091ef647abc

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            9KB

            MD5

            5d5e4ad4cc85ed7e1a6770342f183cfa

            SHA1

            8cb63a77a87f003c8ab295624e9b13ae641149d6

            SHA256

            20eec6a0b0bbd43af3ce94e646e76962a71be1d3afc16afcc0fb92b7eb242e65

            SHA512

            fefa94df9541556439c1001f45401a4c8981051891a07410080a253f33c0c0d218761689fbd8614b75b8bad676c1a14f043d987cca623becc987a0015d54774c

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            015b9d9c20926b87b3e9a54bcf7ba359

            SHA1

            5a32273090cb5237b8881c2b5d3cedde375a8c61

            SHA256

            c2110098f1113db3c5b40637cbbef3871f79c29e2675fa26175884c3453c02cd

            SHA512

            bbbc099541dc8c45a7bb47dc23d041d85144cbbb71cd27a1a62f41dd7fd86b16c048d34dba234a79a47c9fef5a06d459c4e71bd007c9ac0b17ce4845b56b3532

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            959985101b293100e1abfa0cd6f68950

            SHA1

            0fa015f3c45a13cd87e22ee5fb7110cd371e96fd

            SHA256

            a4a84e463abd844af675f6a0da779f2f7e0c72c53fc3dfc9b13fb8d4ea1feb22

            SHA512

            3cdade35ee9544b4cd18b0f5cb4cf8d87eb298422a937b99cf3e7a062f95711854fdc7bbb8164b88b4b11e18939ccb6880c33b300dfb29b5bdb5eaa9aded07a5

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            bcfed100bc898cc55bca0d0b40b17d22

            SHA1

            aaa8b30d3ead353e08f1df99e7854b27c12397b9

            SHA256

            b3cdf52636e54c85891757d708f7971e3e13c29b288dc9cb2fb7d4f8ac2ffea8

            SHA512

            154756edf912fa7965ae3dc3d97b5489d8871068cc6cb9a1b185270118056128192a4c8577f997d124d74de3aa029881d4fdf1d585e9a4006f449ae4aec8dd2f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cepmeakz.0xo.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tmp9C62.tmp
            Filesize

            1KB

            MD5

            5ab8594b92449c1cc0ebbfec2456645d

            SHA1

            cd62052b078690971ee4ca38075589dbe32f7f81

            SHA256

            dd6dc9ae24932eed3e19cee00f077be6f91a65d2ab22806190896326ab0cf22f

            SHA512

            30847b3ecabb1138af782b07dbb7dcbaba7be8ccde4f7bd5680b4a437339430d04697ee3f606bb5873622259f88b0fda99b8d307a026a332d5d8501ddcdc9ec4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
            Filesize

            644KB

            MD5

            2055e529b8767f5ebaee9afcefd16d91

            SHA1

            521d53678fbba3951f19dd2cfed6e4b0d5ef8914

            SHA256

            550aeabbe62d5a14363bac014c16acb456fd2d92ea227d5762a85a51466e3404

            SHA512

            e98333277ff85e147feb5efea6f0376bfbb2cd9bfa361337fdc40c5c211c626b8e7728326d40158e423b33f31eec0cdde3314dee8c19aa82042c747e6aaf01a3

            Download Submit

          • memory/376-24-0x00000000052C0000-0x0000000005326000-memory.dmp

            Filesize

            408KB

            Download

          • memory/376-48-0x000000006C6E0000-0x000000006C72C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/376-20-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/376-18-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/376-75-0x00000000077D0000-0x00000000077DE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/376-74-0x00000000077A0000-0x00000000077B1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/376-73-0x0000000007820000-0x00000000078B6000-memory.dmp

            Filesize

            600KB

            Download

          • memory/376-76-0x00000000077E0000-0x00000000077F4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/376-77-0x00000000078E0000-0x00000000078FA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/376-69-0x0000000007270000-0x0000000007313000-memory.dmp

            Filesize

            652KB

            Download

          • memory/376-47-0x0000000007230000-0x0000000007262000-memory.dmp

            Filesize

            200KB

            Download

          • memory/376-85-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/376-58-0x0000000006830000-0x000000000684E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/392-236-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1048-334-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1228-126-0x0000000072310000-0x000000007235C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1712-136-0x0000000007750000-0x0000000007764000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1712-89-0x0000000005980000-0x0000000005CD4000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/1712-125-0x0000000007700000-0x0000000007711000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1712-113-0x0000000006710000-0x000000000675C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1712-114-0x0000000072310000-0x000000007235C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1712-124-0x0000000007260000-0x0000000007303000-memory.dmp

            Filesize

            652KB

            Download

          • memory/1876-191-0x00000000070A0000-0x00000000070B1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1876-192-0x00000000070E0000-0x00000000070F4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1876-181-0x0000000072010000-0x000000007205C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2084-140-0x00000000064A0000-0x00000000064F0000-memory.dmp

            Filesize

            320KB

            Download

          • memory/2084-142-0x0000000006510000-0x000000000651A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2084-100-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

            Download

          • memory/2084-141-0x00000000066C0000-0x0000000006882000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/2244-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2244-46-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2244-4-0x00000000054A0000-0x0000000005532000-memory.dmp

            Filesize

            584KB

            Download

          • memory/2244-8-0x0000000004CC0000-0x0000000004D28000-memory.dmp

            Filesize

            416KB

            Download

          • memory/2244-5-0x0000000006C20000-0x0000000006C3E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2244-3-0x00000000059B0000-0x0000000005F54000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/2244-2-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2244-9-0x000000000B4F0000-0x000000000B58C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/2244-1-0x0000000000830000-0x00000000008D6000-memory.dmp

            Filesize

            664KB

            Download

          • memory/2244-6-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2244-7-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2432-270-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3008-15-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3008-16-0x0000000005330000-0x0000000005958000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3008-14-0x0000000004C20000-0x0000000004C56000-memory.dmp

            Filesize

            216KB

            Download

          • memory/3008-17-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3008-19-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3008-23-0x0000000005A50000-0x0000000005AB6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3008-72-0x0000000007540000-0x000000000754A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/3008-35-0x0000000005BE0000-0x0000000005F34000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/3008-22-0x00000000051F0000-0x0000000005212000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3008-44-0x00000000061B0000-0x00000000061CE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/3008-45-0x0000000006240000-0x000000000628C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3008-84-0x0000000074BC0000-0x0000000075370000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3008-59-0x000000006C6E0000-0x000000006C72C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3008-70-0x0000000007B20000-0x000000000819A000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/3008-354-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3008-78-0x00000000077F0000-0x00000000077F8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3008-71-0x00000000074D0000-0x00000000074EA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/3020-170-0x0000000072010000-0x000000007205C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3020-180-0x00000000075A0000-0x0000000007643000-memory.dmp

            Filesize

            652KB

            Download

          • memory/3020-169-0x0000000006400000-0x000000000644C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3020-149-0x0000000005D00000-0x0000000006054000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/3740-364-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4532-344-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4956-269-0x00000000076E0000-0x00000000076F4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4956-247-0x00000000076B0000-0x00000000076C1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/4956-235-0x0000000007350000-0x00000000073F3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/4956-225-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4956-224-0x00000000061A0000-0x00000000061EC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/5032-194-0x00000000214E0000-0x0000000021A08000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/5048-281-0x000000006F820000-0x000000006F86C000-memory.dmp

            Filesize

            304KB

            Download