7a947c09326214ca310a22151ab79affdc6fc60ae50c7b392a294df9b906430b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe
Size 3.4MB
Sample260828-xvm37ssta1
SHA256 7a947c09326214ca310a22151ab79affdc6fc60ae50c7b392a294df9b906430b
MD5 319b8c879d5feb0e9acd863f7d58915f
SHA1 caf4742390f134e1e1a19e1a333651b85292a482
SHA512 99cb028bfd9ecf7af2cb7a0926e37cda8e7ff39e878c417fe0ae4c94e1896387fcf577c1244f9580fe1bbabe8d04ae109ae2a2ee38d0be8e031e4a9727de2dd8
SSDEEP 98304:2ej9VL2hOh08WUc5AIWTQj4o21uHuOpJXgsG:JHL2hO28WUsrh2euOpy
TLSH
T1CBF53346AFA7DD1FDE98ED3DFD983ADF5869B9888C1D4F93128968E06C02F341E51102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence upx

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 20 IoCs

resource	yara_rule
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 20 IoCs

resource	yara_rule
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 20 IoCs

resource	yara_rule
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 20 IoCs

resource	yara_rule
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 24 IoCs

resource	yara_rule
behavioral2/memory/4804-0-0x0000000000F20000-0x00000000019C0000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5bf-6.dat	UPX
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	UPX
behavioral2/memory/4252-8-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/896-10-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5792	powershell.exe
5944	powershell.exe
3552	powershell.exe
4372	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4252	juscned.exe
896	juscned.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5380	tasklist.exe
5096	tasklist.exe
3268	tasklist.exe
2568	tasklist.exe
5340	tasklist.exe
772	tasklist.exe
2812	tasklist.exe
4620	tasklist.exe
5576	tasklist.exe
1272	tasklist.exe
4192	tasklist.exe
3912	tasklist.exe
3240	tasklist.exe
1276	tasklist.exe
2348	tasklist.exe
1960	tasklist.exe
1340	tasklist.exe
2756	tasklist.exe
4080	tasklist.exe
2992	tasklist.exe
828	tasklist.exe
3164	tasklist.exe
5356	tasklist.exe
5612	tasklist.exe
5540	tasklist.exe
2864	tasklist.exe
5460	tasklist.exe
1448	tasklist.exe
2440	tasklist.exe
3912	tasklist.exe
3212	tasklist.exe
256	tasklist.exe
3332	tasklist.exe
2744	tasklist.exe
6036	tasklist.exe
3272	tasklist.exe
5624	tasklist.exe
264	tasklist.exe
5908	tasklist.exe
264	tasklist.exe
3028	tasklist.exe
3896	tasklist.exe
784	tasklist.exe
4200	tasklist.exe
3400	tasklist.exe
4744	tasklist.exe
5792	tasklist.exe
3240	tasklist.exe
2812	tasklist.exe
2220	tasklist.exe
2540	tasklist.exe
2744	tasklist.exe
556	tasklist.exe
5428	tasklist.exe
4076	tasklist.exe
3564	tasklist.exe
3268	tasklist.exe
3188	tasklist.exe
1172	tasklist.exe
3212	tasklist.exe
4984	tasklist.exe
4728	tasklist.exe
1340	tasklist.exe
1620	tasklist.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4804-0-0x0000000000F20000-0x00000000019C0000-memory.dmp	upx
behavioral2/files/0x000c00000001c5bf-6.dat	upx
behavioral2/memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp	upx
behavioral2/memory/4252-8-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/896-10-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5660	schtasks.exe
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	5908	tasklist.exe
Token: SeDebugPrivilege	3584	tasklist.exe
Token: SeDebugPrivilege	4748	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	3896	tasklist.exe
Token: SeDebugPrivilege	1172	tasklist.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	3912	tasklist.exe
Token: SeDebugPrivilege	1960	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	3668	tasklist.exe
Token: SeDebugPrivilege	784	tasklist.exe
Token: SeDebugPrivilege	5276	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	256	tasklist.exe
Token: SeDebugPrivilege	3272	tasklist.exe
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeDebugPrivilege	4872	tasklist.exe
Token: SeDebugPrivilege	3400	tasklist.exe
Token: SeDebugPrivilege	3544	tasklist.exe
Token: SeDebugPrivilege	1620	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	264	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	3268	tasklist.exe
Token: SeDebugPrivilege	1112	tasklist.exe
Token: SeDebugPrivilege	3564	tasklist.exe
Token: SeDebugPrivilege	5380	tasklist.exe
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	1340	tasklist.exe
Token: SeDebugPrivilege	6036	tasklist.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeDebugPrivilege	856	tasklist.exe
Token: SeDebugPrivilege	3240	tasklist.exe
Token: SeDebugPrivilege	5772	tasklist.exe
Token: SeDebugPrivilege	2192	tasklist.exe
Token: SeDebugPrivilege	5096	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	1912	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	1276	tasklist.exe
Token: SeDebugPrivilege	5540	tasklist.exe
Token: SeDebugPrivilege	3332	tasklist.exe
Token: SeDebugPrivilege	4984	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	3088	tasklist.exe
Token: SeDebugPrivilege	264	tasklist.exe
Token: SeDebugPrivilege	1600	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	5664	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	3896	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5004	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	89
PID 4804 wrote to memory of 5908	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	92
PID 4804 wrote to memory of 3584	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	94
PID 4804 wrote to memory of 4748	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	96
PID 4804 wrote to memory of 4636	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	98
PID 4804 wrote to memory of 2812	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	100
PID 4804 wrote to memory of 3896	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	102
PID 4804 wrote to memory of 1172	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	104
PID 4804 wrote to memory of 3056	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	106
PID 4804 wrote to memory of 2884	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	108
PID 4804 wrote to memory of 3912	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	110
PID 4804 wrote to memory of 1960	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	112
PID 4804 wrote to memory of 3320	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	114
PID 4804 wrote to memory of 3668	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	116
PID 4804 wrote to memory of 784	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	118
PID 4804 wrote to memory of 5276	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	120
PID 4804 wrote to memory of 3212	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	182
PID 4804 wrote to memory of 256	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	124
PID 4804 wrote to memory of 3272	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	126
PID 4804 wrote to memory of 1844	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	128
PID 4804 wrote to memory of 2540	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	304
PID 4804 wrote to memory of 4872	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	132
PID 4804 wrote to memory of 3400	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	134
PID 4804 wrote to memory of 3544	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	136
PID 4804 wrote to memory of 1620	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	138
PID 4804 wrote to memory of 3044	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	326
PID 4804 wrote to memory of 4620	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	142
PID 4804 wrote to memory of 5624	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	368
PID 4804 wrote to memory of 264	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	204
PID 4804 wrote to memory of 4420	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	148
PID 4804 wrote to memory of 3268	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	266
PID 4804 wrote to memory of 1112	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	152
PID 4804 wrote to memory of 3564	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	269
PID 4804 wrote to memory of 5380	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	373
PID 4804 wrote to memory of 4964	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	379
PID 4804 wrote to memory of 2812	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	328
PID 4804 wrote to memory of 1340	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	380
PID 4804 wrote to memory of 6036	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	386
PID 4804 wrote to memory of 3056	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	166
PID 4804 wrote to memory of 856	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	229
PID 4804 wrote to memory of 3240	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	287
PID 4804 wrote to memory of 5772	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	393
PID 4804 wrote to memory of 2192	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	174
PID 4804 wrote to memory of 5096	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	176
PID 4804 wrote to memory of 4084	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	178
PID 4804 wrote to memory of 1912	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	180
PID 4804 wrote to memory of 3212	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	182
PID 4804 wrote to memory of 4576	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	184
PID 4804 wrote to memory of 1276	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	186
PID 4804 wrote to memory of 5660	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	188
PID 4804 wrote to memory of 4252	4804	2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe	190
PID 4252 wrote to memory of 5540	4252	juscned.exe	192
PID 4252 wrote to memory of 3332	4252	juscned.exe	309
PID 4252 wrote to memory of 4984	4252	juscned.exe	375
PID 896 wrote to memory of 2744	896	juscned.exe	258
PID 4252 wrote to memory of 4572	4252	juscned.exe	200
PID 896 wrote to memory of 3088	896	juscned.exe	202
PID 4252 wrote to memory of 264	4252	juscned.exe	204
PID 896 wrote to memory of 2016	896	juscned.exe	206
PID 4252 wrote to memory of 1600	4252	juscned.exe	324
PID 4252 wrote to memory of 4728	4252	juscned.exe	210
PID 896 wrote to memory of 5664	896	juscned.exe	329
PID 4252 wrote to memory of 1540	4252	juscned.exe	378
PID 4252 wrote to memory of 4288	4252	juscned.exe	377

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_319b8c879d5feb0e9acd863f7d58915f_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:784
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5276
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5660
- C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
  "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --installed
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:264
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    - Discovers running processes
    PID:2756
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    - Discovers running processes
    PID:4744
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    PID:6044
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    PID:2440
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    PID:5376
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    PID:4564
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    - Discovers running processes
    PID:2348
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:5460
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    - Discovers running processes
    PID:4080
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    PID:2008
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    - Discovers running processes
    PID:2744
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:1996
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:2316
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    PID:3584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3564
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:2568
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    PID:5852
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    PID:3764
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    - Discovers running processes
    PID:6036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    PID:5908
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    - Discovers running processes
    PID:3240
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    PID:4700
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    PID:2808
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    PID:5944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    PID:6012
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    PID:2540
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    PID:2604
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:5612
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:3164
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:2312
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:772
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    - Discovers running processes
    PID:4192
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    PID:1600
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:3044
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    PID:3860
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    PID:5156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    PID:4388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3764
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    - Discovers running processes
    PID:5428
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1272
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    PID:4316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:828
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:4484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6044
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5944
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4372

C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Discovers running processes
  PID:1272
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  PID:4484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:856
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:5844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:2864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:4200
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  PID:4668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  PID:2992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:4984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:5864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  PID:3268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  PID:4256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Discovers running processes
  PID:5340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  PID:5792
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  PID:1448
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:4408
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:4188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3332
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  PID:556
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:5356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:2812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5664
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:5684
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Discovers running processes
  PID:3912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:4712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:3204
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  PID:1828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:4076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  PID:5576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:5624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:5168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:1132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5380
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:5280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Discovers running processes
  PID:3028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:1540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  PID:1340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:3184
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  PID:3188
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:6036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  PID:2464
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  PID:2220
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:1688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5772
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:5920
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  PID:2440

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv AKxBh2ygrk2qwcG53yJmSg.0.2
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

juscned.exe

Path C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
Size 3.4MB
SHA256 7a947c09326214ca310a22151ab79affdc6fc60ae50c7b392a294df9b906430b
MD5 319b8c879d5feb0e9acd863f7d58915f
SHA1 caf4742390f134e1e1a19e1a333651b85292a482
SHA512 99cb028bfd9ecf7af2cb7a0926e37cda8e7ff39e878c417fe0ae4c94e1896387fcf577c1244f9580fe1bbabe8d04ae109ae2a2ee38d0be8e031e4a9727de2dd8
SSDEEP 98304:2ej9VL2hOh08WUc5AIWTQj4o21uHuOpJXgsG:JHL2hO28WUsrh2euOpy
TLSH
T1CBF53346AFA7DD1FDE98ED3DFD983ADF5869B9888C1D4F93128968E06C02F341E51102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fkclne14.ern.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fkclne14.ern.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

juscned_task.xml

Path C:\Users\Admin\AppData\Local\Temp\juscned_task.xml
Size 1KB
SHA256 f400ac3c7ef2b410a693a9d6ef28877a42376de678c57907a97782b60d0ce695
MD5 0bf9615f5313d3a19dc2d987d19ba46b
SHA1 fa2d7c9d95feef754d27fc28b2b0fc8c3b5f137f
SHA512 cff34ab4ce0a3a8abd64fdc684fee6228254b715e63b8a384ab23c007a981dd72b4381ef02c06426227bbb0d6df1b5af76e983e4450baa1e581621ae7ffa3a84
TLSH
T1802132909C15F12F755A973ECB915383367E6BA90BB54038D9CC4DBC748A1CAB10397B
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 945B
SHA256 7b446fd907fd3742e9e6c41ed3ee5f1115568fd9d20e268441340894c08b5887
MD5 83b26c8f28c1b41af24274e6d82a66e5
SHA1 e057e918d10015aedb34bc684dd542ca16030da8
SHA512 db74c2edf757dc3aef91eb7d8068c336b4e8f5001417e3d1202540b9868b3031f054a263099df211c443906360b6628f25f401f7632504182d433484fcf405d3
TLSH
T1D01157C03CDD4A3105064A8BC1A225CEFCAE68681E02686C8315CA1E92E9C1DBFC337E
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 2KB
SHA256 62381002351f3d8419a698c437b0605321991ad163cfc9dcc53b606097b04b50
MD5 a6f5f7b454f1e7b6c1c49146ed790223
SHA1 4d04d3cabdf030abfc0fe7b59466a88fe56b02e7
SHA512 d47f10e047927ac5a34ae112b1f88dbafe6b429a14960263761e56adc0784904e3cb43d8774c3933bc26ec77ac400eb09fbc113e2d4d3b339ff2fee506b290ac
TLSH
T18851A980799C583241850F8A72A306DEBC6F98748EC21D1C525D6B5FD1D4C1E3BAEB7D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/896-34-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/896-39-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/896-37-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/896-10-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/896-33-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-42-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-47-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-31-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-52-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-36-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-8-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-51-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-40-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-41-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-50-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-43-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-45-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-46-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-32-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-48-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4252-49-0x0000000000480000-0x0000000000F20000-memory.dmp

Download

memory/4804-0-0x0000000000F20000-0x00000000019C0000-memory.dmp

Download

memory/4804-7-0x0000000000F20000-0x00000000019C0000-memory.dmp

Download

memory/5792-17-0x000001EDF0690000-0x000001EDF06B2000-memory.dmp

Download