53554bf469742b0dca6171adab311de7fcc546825921027e8cd3b505b449eab4

Analysis

max time kernel
114s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Size 78.0MB
Sample260824-act3gabe88
SHA256 53554bf469742b0dca6171adab311de7fcc546825921027e8cd3b505b449eab4
MD5 b6bd411878e0edc0e8e385f32f05f4dc
SHA1 215bb401e67d085cac672ac1bd04f85f902dfd34
SHA512 c777e54a895be4867117af9570931e179ae34100cec950be4a085e075b1271f71463d056936bfacc19a6b0ca1da6ff0ebc37b31ed05220970140ae2bd61cff50
SSDEEP 393216:QudfkmUkZrDZF3fUwHpfGUafqLf8OhFO1mUJZgyD4Pp2VKBvhh9ep0R2v86CaG+8:QG7Qap2VNDvHIRSBQszki2QNSrxcin
TLSH
T1C208BE06B3E505A3D5A392348A9B0207E372B4635734DBDB719C43582FEB7E48A7B760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Clipboard Data 1 TTPs 64 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1784	cmd.exe
5272	powershell.exe
2764	powershell.exe
2360	cmd.exe
5860	cmd.exe
2864	cmd.exe
3976	cmd.exe
3332	powershell.exe
4860	cmd.exe
1920	powershell.exe
5740	cmd.exe
1932	cmd.exe
3700	cmd.exe
4888	cmd.exe
5012	cmd.exe
5808	powershell.exe
2296	cmd.exe
4004	cmd.exe
2536	cmd.exe
1972	cmd.exe
5940	cmd.exe
4864	powershell.exe
2004	powershell.exe
3788	powershell.exe
2632	powershell.exe
3440	powershell.exe
6016	powershell.exe
4244	powershell.exe
4712	cmd.exe
4840	cmd.exe
1744	cmd.exe
4992	cmd.exe
2508	powershell.exe
3376	cmd.exe
5072	cmd.exe
4672	powershell.exe
2056	cmd.exe
2832	powershell.exe
1364	powershell.exe
1384	cmd.exe
5832	cmd.exe
4684	powershell.exe
2916	cmd.exe
5552	cmd.exe
5648	powershell.exe
1680	powershell.exe
5544	powershell.exe
4380	cmd.exe
2152	cmd.exe
4944	cmd.exe
1780	powershell.exe
4964	cmd.exe
6132	cmd.exe
4896	cmd.exe
1188	cmd.exe
4496	powershell.exe
5996	powershell.exe
1860	powershell.exe
3504	powershell.exe
3504	cmd.exe
2528	powershell.exe
4560	powershell.exe
3816	cmd.exe
4292	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe

Loads dropped DLL 3 IoCs

pid	Process
4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com
12	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
13	ipinfo.io

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5500	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5404	powershell.exe
2460	powershell.exe
5188	powershell.exe
5072	powershell.exe
3376	powershell.exe
2960	powershell.exe
2956	powershell.exe
5108	powershell.exe
4824	powershell.exe
4136	powershell.exe
3696	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5128	cmd.exe
4936	cmd.exe
4260	cmd.exe
1392	cmd.exe
2892	cmd.exe
988	cmd.exe
1308	cmd.exe
1548	cmd.exe
2908	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2720	ping.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2724	NETSTAT.EXE
5472	ipconfig.exe
5164	NETSTAT.EXE
4744	NETSTAT.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2720	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
1100	powershell.exe
1100	powershell.exe
4136	powershell.exe
4136	powershell.exe
2460	powershell.exe
5404	powershell.exe
2460	powershell.exe
5404	powershell.exe
5108	powershell.exe
5108	powershell.exe
2956	powershell.exe
2956	powershell.exe
5072	powershell.exe
5072	powershell.exe
3376	powershell.exe
3376	powershell.exe
4824	powershell.exe
4824	powershell.exe
3696	powershell.exe
3696	powershell.exe
5188	powershell.exe
5188	powershell.exe
5072	powershell.exe
2956	powershell.exe
4824	powershell.exe
3376	powershell.exe
5188	powershell.exe
4136	powershell.exe
5404	powershell.exe
5108	powershell.exe
2460	powershell.exe
1412	powershell.exe
1412	powershell.exe
3696	powershell.exe
1412	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe
5272	powershell.exe
5272	powershell.exe
5272	powershell.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	5188	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4824	powershell.exe
Token: SeSecurityPrivilege	4824	powershell.exe
Token: SeTakeOwnershipPrivilege	4824	powershell.exe
Token: SeLoadDriverPrivilege	4824	powershell.exe
Token: SeSystemProfilePrivilege	4824	powershell.exe
Token: SeSystemtimePrivilege	4824	powershell.exe
Token: SeProfSingleProcessPrivilege	4824	powershell.exe
Token: SeIncBasePriorityPrivilege	4824	powershell.exe
Token: SeCreatePagefilePrivilege	4824	powershell.exe
Token: SeBackupPrivilege	4824	powershell.exe
Token: SeRestorePrivilege	4824	powershell.exe
Token: SeShutdownPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeSystemEnvironmentPrivilege	4824	powershell.exe
Token: SeRemoteShutdownPrivilege	4824	powershell.exe
Token: SeUndockPrivilege	4824	powershell.exe
Token: SeManageVolumePrivilege	4824	powershell.exe
Token: 33	4824	powershell.exe
Token: 34	4824	powershell.exe
Token: 35	4824	powershell.exe
Token: 36	4824	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	4744	NETSTAT.EXE
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4936	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	90
PID 4936 wrote to memory of 2080	4936	cmd.exe	92
PID 4512 wrote to memory of 5328	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	93
PID 5328 wrote to memory of 1100	5328	cmd.exe	94
PID 4512 wrote to memory of 2892	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	95
PID 2892 wrote to memory of 5164	2892	cmd.exe	97
PID 5164 wrote to memory of 988	5164	NETSTAT.EXE	98
PID 988 wrote to memory of 3808	988	cmd.exe	99
PID 4512 wrote to memory of 4260	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	100
PID 4512 wrote to memory of 2956	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	101
PID 4512 wrote to memory of 5108	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	102
PID 4512 wrote to memory of 2460	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	103
PID 4512 wrote to memory of 4824	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	104
PID 4512 wrote to memory of 5188	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	105
PID 4512 wrote to memory of 5072	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	106
PID 4512 wrote to memory of 4136	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	107
PID 4512 wrote to memory of 3376	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	108
PID 4512 wrote to memory of 3696	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	109
PID 4512 wrote to memory of 2720	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	110
PID 4512 wrote to memory of 5404	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	111
PID 4260 wrote to memory of 4744	4260	cmd.exe	124
PID 4512 wrote to memory of 360	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	125
PID 360 wrote to memory of 1412	360	cmd.exe	137
PID 3696 wrote to memory of 2152	3696	powershell.exe	127
PID 4512 wrote to memory of 4660	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	130
PID 4660 wrote to memory of 2980	4660	cmd.exe	131
PID 2956 wrote to memory of 1444	2956	powershell.exe	134
PID 1444 wrote to memory of 1860	1444	query.exe	135
PID 4512 wrote to memory of 4832	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	136
PID 4832 wrote to memory of 1412	4832	cmd.exe	137
PID 4512 wrote to memory of 6000	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	138
PID 6000 wrote to memory of 768	6000	cmd.exe	139
PID 4512 wrote to memory of 4992	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	140
PID 4992 wrote to memory of 1780	4992	cmd.exe	141
PID 4512 wrote to memory of 1392	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	144
PID 1392 wrote to memory of 2724	1392	cmd.exe	146
PID 2724 wrote to memory of 1308	2724	NETSTAT.EXE	147
PID 1308 wrote to memory of 5664	1308	cmd.exe	171
PID 4512 wrote to memory of 2960	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	149
PID 4512 wrote to memory of 4964	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	151
PID 4964 wrote to memory of 5272	4964	cmd.exe	175
PID 4512 wrote to memory of 1548	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	153
PID 1548 wrote to memory of 4896	1548	cmd.exe	202
PID 4512 wrote to memory of 2908	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	156
PID 2908 wrote to memory of 5472	2908	cmd.exe	158
PID 4512 wrote to memory of 6132	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	159
PID 6132 wrote to memory of 3052	6132	cmd.exe	160
PID 4512 wrote to memory of 5612	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	161
PID 5612 wrote to memory of 2944	5612	cmd.exe	162
PID 4512 wrote to memory of 5128	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	163
PID 5128 wrote to memory of 5500	5128	cmd.exe	164
PID 4512 wrote to memory of 4592	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	165
PID 4592 wrote to memory of 2632	4592	cmd.exe	166
PID 4512 wrote to memory of 5748	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	167
PID 5748 wrote to memory of 4416	5748	cmd.exe	168
PID 4512 wrote to memory of 3700	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	169
PID 3700 wrote to memory of 2472	3700	cmd.exe	170
PID 4512 wrote to memory of 5664	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	171
PID 5664 wrote to memory of 2920	5664	cmd.exe	172
PID 4512 wrote to memory of 5148	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	174
PID 5148 wrote to memory of 5272	5148	cmd.exe	175
PID 4512 wrote to memory of 1892	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	176
PID 1892 wrote to memory of 3332	1892	cmd.exe	177
PID 4512 wrote to memory of 2916	4512	2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b6bd411878e0edc0e8e385f32f05f4dc_avaddon_cobalt-strike_coinminer_glassworm_icedid_luca-st.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:988
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\NETSTAT.EXE
    netstat -nao
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\query.exe
    "C:\Windows\system32\query.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\system32\quser.exe
      "C:\Windows\system32\quser.exe"
      4⤵
      PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show networks mode=Bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2152
- C:\Windows\system32\ping.exe
  ping 8.8.8.8 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2116

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6128

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5764

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 2fde68301bb6169cd3adc080e3200576d9f10fbc509b0915acfde17f5a1084ab
MD5 f20e7443cb2df04a90d2e4cd9e9cd621
SHA1 535ea8d245ff10bc4db8fca061c8dcc9f1cf0bb6
SHA512 3746dfd01136fd7d8a1f7111b135f13923500de35ed2aee32ac459e2de1ee50874e15b9332c0c4309f8453733472a6565885af482e82d65c56be1a8caea75c33
TLSH
T128316833B3DC8BA1C88A417E10DA9C5031B7C7C790AECEDB6B5CD564A02F697CE65560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 32cb9de8f353647667b7f924bb30db77f8f0fb89be6c64bcdafe6ae2081e4f65
MD5 2383e5b8258b4bd2bad92d11b4ee415a
SHA1 dd6c9b285acbb1a9edb3b33e7ca18777dabe3934
SHA512 2155a637f6b103621880dee3bed745943dd0c1bea39e86852e3df7d1639b8b64346e5bdd03b6acef332ad8ee2b9f2caf0eb675a5c0ba70393e54b77a40440739
TLSH
T1D8318623B3D887A0C899517E20D99C5032BB83CB809ECEDB2B8CD125A42F697CE61520
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 9755b1e9f88f8306c157dd6385673f972e974cb6cb353821ae00cc72f5e6ba9b
MD5 95a17cf701203572bbc983b573ba23f8
SHA1 ad38aca703c2a852e9149c7b0972e0c6a90218a4
SHA512 796d9127bf828cbe356562c6a2336a713aa063ee1b657819ef2b93aba9cb28e90436ad476127870045e9ca924432e4b027c1f1e7761cc08cf56a43fbe26245d9
TLSH
T14D316833B3DC8BA1D88A417E10D99C6031B7C7C790AECEDB6B9CD564A02F697CE61560
MD5 SHA1 SHA512 TLSH

Submit Download