Overview

overview

10

Static

static

10

2026-10-03...ve.exe

windows10-2004-x64

10

2026-10-03...ve.exe

windows11-ltsc_2024-x64

10

Resubmissions

04/10/2026, 22:37

261004-2ka34ssyfx10

04/10/2026, 17:58

261004-wkavfstfkf10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/10/2026, 17:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
  • Size 4.4MB
  • Sample261004-wkavfstfkf
  • SHA256 5084876479bbbfb818033085cba362a3eaee8b784db172271f4cdba0243a3e88
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionwebratpersistencerattrojanupx

Malware Config

Signatures

  • Family: WebRAT

    WebRAT is a Windows RAT written in Golang.

    ratwebrat
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 36 IoCs
  • Custom signature
    Detects executables referencing many IR and analysis tools 36 IoCs
  • Custom signature
    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 36 IoCs
  • Custom signature
    Detects executables referencing virtualization MAC addresses 36 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 40 IoCs
  • Custom signature
    detects Windows exceutables potentially bypassing UAC using fodhelper.exe 36 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 64 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq wireshark.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1364
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4944
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procmon.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3816
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procmon64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6004
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3600
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4824
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq processhacker.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1628
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:796
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1308
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idag.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3080
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idag64.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idaw.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5864
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idaw64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3736
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq fiddler.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5204
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4912
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4664
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq dnspy.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1556
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq pestudio.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5308
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq hxd.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq devenv.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1496
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq windbg.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5764
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq autoruns.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:3884
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq filemon.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:596
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq regmon.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:832
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6132
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4804
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:804
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2396
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq xenservice.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5212
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2536
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3168
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3540
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3828
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1500
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:3560
    • C:\Windows\system32\schtasks.exe
      schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml /TN 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:472
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe --installed
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq wireshark.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4656
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:992
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procmon.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procmon64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procexp.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procexp64.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2816
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq processhacker.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:6004
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1484
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1340
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ida.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4708
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ida64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5696
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idag.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1136
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idag64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idaw.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idaw64.exe" /NH
        3⤵
        • Discovers running processes
        PID:6076
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq fiddler.exe" /NH
        3⤵
        • Discovers running processes
        PID:5244
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
        3⤵
          PID:6120
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
          3⤵
          • Discovers running processes
          PID:2584
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq dnspy.exe" /NH
          3⤵
            PID:1552
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq pestudio.exe" /NH
            3⤵
              PID:2656
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
              3⤵
                PID:4920
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq hxd.exe" /NH
                3⤵
                  PID:5764
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq devenv.exe" /NH
                  3⤵
                    PID:3892
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq windbg.exe" /NH
                    3⤵
                      PID:1936
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
                      3⤵
                        PID:4960
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
                        3⤵
                          PID:2228
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq autoruns.exe" /NH
                          3⤵
                            PID:4784
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
                            3⤵
                              PID:3308
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq filemon.exe" /NH
                              3⤵
                                PID:3392
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FI "IMAGENAME eq regmon.exe" /NH
                                3⤵
                                  PID:5928
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
                                  3⤵
                                    PID:3132
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
                                    3⤵
                                      PID:2092
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
                                      3⤵
                                      • Discovers running processes
                                      PID:1236
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
                                      3⤵
                                        PID:5084
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
                                        3⤵
                                        • Discovers running processes
                                        PID:4200
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
                                        3⤵
                                          PID:3004
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
                                          3⤵
                                            PID:4944
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
                                            3⤵
                                            • Discovers running processes
                                            PID:1504
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FI "IMAGENAME eq xenservice.exe" /NH
                                            3⤵
                                              PID:5836
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
                                              3⤵
                                                PID:4592
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
                                                3⤵
                                                  PID:2428
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
                                                  3⤵
                                                  • Discovers running processes
                                                  PID:2752
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
                                                  3⤵
                                                    PID:5204
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
                                                    3⤵
                                                      PID:5232
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
                                                      3⤵
                                                        PID:2596
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
                                                        3⤵
                                                          PID:5128
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
                                                          3⤵
                                                            PID:4920
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
                                                            3⤵
                                                              PID:4300
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml /TN 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive /F
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:596
                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                              C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe --watchdog 1900 --wd-target C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:1936
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Enumerates connected drives
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3252
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Enumerates connected drives
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2796
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Enumerates connected drives
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1944
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Enumerates connected drives
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5404
                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          PID:2100
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq wireshark.exe" /NH
                                                            2⤵
                                                              PID:2956
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
                                                              2⤵
                                                              • Discovers running processes
                                                              PID:2904
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /FI "IMAGENAME eq procmon.exe" /NH
                                                              2⤵
                                                                PID:2124
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist /FI "IMAGENAME eq procmon64.exe" /NH
                                                                2⤵
                                                                  PID:4144
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FI "IMAGENAME eq procexp.exe" /NH
                                                                  2⤵
                                                                    PID:3736
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
                                                                    2⤵
                                                                      PID:5896
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FI "IMAGENAME eq processhacker.exe" /NH
                                                                      2⤵
                                                                      • Discovers running processes
                                                                      PID:2976
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
                                                                      2⤵
                                                                        PID:4440
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
                                                                        2⤵
                                                                          PID:2880
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
                                                                          2⤵
                                                                            PID:5792
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /FI "IMAGENAME eq ida.exe" /NH
                                                                            2⤵
                                                                              PID:796
                                                                            • C:\Windows\system32\tasklist.exe
                                                                              tasklist /FI "IMAGENAME eq ida64.exe" /NH
                                                                              2⤵
                                                                                PID:2972
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq idag.exe" /NH
                                                                                2⤵
                                                                                  PID:3496
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq idag64.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:1204
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq idaw.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:864
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:1808
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:4652
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:1880
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
                                                                                  2⤵
                                                                                  • Discovers running processes
                                                                                  PID:4520
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
                                                                                  2⤵
                                                                                    PID:5424
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
                                                                                    2⤵
                                                                                      PID:4784
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
                                                                                      2⤵
                                                                                      • Discovers running processes
                                                                                      PID:3308
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq hxd.exe" /NH
                                                                                      2⤵
                                                                                        PID:5940
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist /FI "IMAGENAME eq devenv.exe" /NH
                                                                                        2⤵
                                                                                          PID:5456
                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq windbg.exe" /NH
                                                                                          2⤵
                                                                                            PID:4540
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
                                                                                            2⤵
                                                                                              PID:5076
                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                              tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
                                                                                              2⤵
                                                                                                PID:5376
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq autoruns.exe" /NH
                                                                                                2⤵
                                                                                                  PID:6064
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
                                                                                                  2⤵
                                                                                                    PID:4828
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq filemon.exe" /NH
                                                                                                    2⤵
                                                                                                    • Discovers running processes
                                                                                                    PID:5040
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq regmon.exe" /NH
                                                                                                    2⤵
                                                                                                      PID:1376
                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                      tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
                                                                                                      2⤵
                                                                                                        PID:3376
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
                                                                                                        2⤵
                                                                                                          PID:3440
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
                                                                                                          2⤵
                                                                                                          • Discovers running processes
                                                                                                          PID:4500
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
                                                                                                          2⤵
                                                                                                            PID:5256
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
                                                                                                            2⤵
                                                                                                            • Discovers running processes
                                                                                                            PID:5544
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
                                                                                                            2⤵
                                                                                                              PID:4160
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
                                                                                                              2⤵
                                                                                                              • Discovers running processes
                                                                                                              PID:6088
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
                                                                                                              2⤵
                                                                                                                PID:5532
                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                tasklist /FI "IMAGENAME eq xenservice.exe" /NH
                                                                                                                2⤵
                                                                                                                  PID:3592
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
                                                                                                                  2⤵
                                                                                                                  • Discovers running processes
                                                                                                                  PID:4444
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
                                                                                                                  2⤵
                                                                                                                    PID:1368
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
                                                                                                                    2⤵
                                                                                                                      PID:5748
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
                                                                                                                      2⤵
                                                                                                                      • Discovers running processes
                                                                                                                      PID:1628
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
                                                                                                                      2⤵
                                                                                                                      • Discovers running processes
                                                                                                                      PID:2404
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
                                                                                                                      2⤵
                                                                                                                      • Discovers running processes
                                                                                                                      PID:4420
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
                                                                                                                      2⤵
                                                                                                                      • Discovers running processes
                                                                                                                      PID:4996
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
                                                                                                                      2⤵
                                                                                                                        PID:3548
                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                        tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
                                                                                                                        2⤵
                                                                                                                          PID:4696
                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        PID:3180
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FI "IMAGENAME eq wireshark.exe" /NH
                                                                                                                          2⤵
                                                                                                                            PID:5012
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
                                                                                                                            2⤵
                                                                                                                              PID:1624
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /FI "IMAGENAME eq procmon.exe" /NH
                                                                                                                              2⤵
                                                                                                                                PID:2804
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                tasklist /FI "IMAGENAME eq procmon64.exe" /NH
                                                                                                                                2⤵
                                                                                                                                • Discovers running processes
                                                                                                                                PID:4628
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                tasklist /FI "IMAGENAME eq procexp.exe" /NH
                                                                                                                                2⤵
                                                                                                                                • Discovers running processes
                                                                                                                                PID:4252
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                tasklist /FI "IMAGENAME eq procexp64.exe" /NH
                                                                                                                                2⤵
                                                                                                                                  PID:596
                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
                                                                                                                                  2⤵
                                                                                                                                    PID:820
                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
                                                                                                                                    2⤵
                                                                                                                                      PID:4804
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
                                                                                                                                      2⤵
                                                                                                                                      • Discovers running processes
                                                                                                                                      PID:3312
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
                                                                                                                                      2⤵
                                                                                                                                        PID:3268
                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                        tasklist /FI "IMAGENAME eq ida.exe" /NH
                                                                                                                                        2⤵
                                                                                                                                        • Discovers running processes
                                                                                                                                        PID:6064
                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                        tasklist /FI "IMAGENAME eq ida64.exe" /NH
                                                                                                                                        2⤵
                                                                                                                                          PID:4148
                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                          tasklist /FI "IMAGENAME eq idag.exe" /NH
                                                                                                                                          2⤵
                                                                                                                                            PID:3048
                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                            tasklist /FI "IMAGENAME eq idag64.exe" /NH
                                                                                                                                            2⤵
                                                                                                                                              PID:3540
                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                              tasklist /FI "IMAGENAME eq idaw.exe" /NH
                                                                                                                                              2⤵
                                                                                                                                              • Discovers running processes
                                                                                                                                              PID:1500
                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                              tasklist /FI "IMAGENAME eq idaw64.exe" /NH
                                                                                                                                              2⤵
                                                                                                                                                PID:472
                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                tasklist /FI "IMAGENAME eq fiddler.exe" /NH
                                                                                                                                                2⤵
                                                                                                                                                  PID:4324
                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2112
                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4444
                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                      tasklist /FI "IMAGENAME eq dnspy.exe" /NH
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1276
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FI "IMAGENAME eq pestudio.exe" /NH
                                                                                                                                                        2⤵
                                                                                                                                                        • Discovers running processes
                                                                                                                                                        PID:5288
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
                                                                                                                                                        2⤵
                                                                                                                                                        • Discovers running processes
                                                                                                                                                        PID:5696
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FI "IMAGENAME eq hxd.exe" /NH
                                                                                                                                                        2⤵
                                                                                                                                                        • Discovers running processes
                                                                                                                                                        PID:3608
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FI "IMAGENAME eq devenv.exe" /NH
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2040
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq windbg.exe" /NH
                                                                                                                                                          2⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          PID:5628
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
                                                                                                                                                          2⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          PID:5964
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2888
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq autoruns.exe" /NH
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4248
                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                              tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
                                                                                                                                                              2⤵
                                                                                                                                                              • Discovers running processes
                                                                                                                                                              PID:3296
                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                              tasklist /FI "IMAGENAME eq filemon.exe" /NH
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2648
                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                tasklist /FI "IMAGENAME eq regmon.exe" /NH
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3892
                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4520
                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4900
                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                      tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Discovers running processes
                                                                                                                                                                      PID:3312
                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                      tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5940
                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                        tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1232
                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                          tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5376
                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                            tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3048
                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                              tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3828
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FI "IMAGENAME eq xenservice.exe" /NH
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Discovers running processes
                                                                                                                                                                                PID:1236
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Discovers running processes
                                                                                                                                                                                PID:5692
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Discovers running processes
                                                                                                                                                                                PID:5400
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3004
                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4092
                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5892
                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                      tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5288
                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                        tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Discovers running processes
                                                                                                                                                                                        PID:1744
                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                        tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5488
                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                          tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Discovers running processes
                                                                                                                                                                                          PID:1432
                                                                                                                                                                                      • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                        C:\Windows\System32\sihclient.exe /cv eX3CTPO/B0qMAsHbgHmqfA.0.2
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5896

                                                                                                                                                                                        Network

                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                              Downloads

                                                                                                                                                                                              2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
                                                                                                                                                                                              • Size 4.4MB
                                                                                                                                                                                              • SHA256 5084876479bbbfb818033085cba362a3eaee8b784db172271f4cdba0243a3e88
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 ed01f15ee28c57778f8f205ebba5ccc705c0eaebc68bdf47159c3886ca4ae25c
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 8ae4d7653a2a280b0bd5dcae08e8fe7f7d998c26d9559508f5008627f852e0fe
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              __PSScriptPolicyTest_dwxgfjnu.a3o.psm1
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dwxgfjnu.a3o.psm1
                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              wruntime.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 139553c3df891d42ffa593707fb31a2856766ddc5a2cf0612af7e344a2662600
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              wruntime.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 0072e7aed7bcd13e04c0a7f460f0bbaa251cfef6ba30bdbbcf6462bbf26aa248
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              wruntime.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 df0b5f6e2645c861453c88de383825ebaeccd2419f6c17850c9089cf7cdeff49
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              wruntime.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                              • SHA256 9c1ec552dfe627b231c8c2ebda32e63f5d17e3c8073b495da115c601d569170b
                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              memory/1900-73-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-65-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-52-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-36-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-69-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-38-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-67-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-71-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-63-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-75-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-9-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-61-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-45-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-58-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-56-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1900-54-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-60-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-41-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-53-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-49-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-55-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-74-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-57-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-17-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-72-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-70-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-62-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-68-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-64-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1936-66-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2100-51-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2100-37-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2100-44-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2524-0-0x0000000000240000-0x0000000001066000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2524-8-0x0000000000240000-0x0000000001066000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3180-40-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3180-39-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3180-46-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3180-48-0x0000000000040000-0x0000000000E66000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3252-20-0x0000028CE2320000-0x0000028CE2342000-memory.dmp
                                                                                                                                                                                              Download