a417bae20126343722569d00cbb866382ee0d3bc38aae101114bd440ecbd419a

Analysis

max time kernel
143s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Size 70.6MB
Sample260824-edpxcssfmf
SHA256 a417bae20126343722569d00cbb866382ee0d3bc38aae101114bd440ecbd419a
MD5 9d7f90fd7e850d4df015d62e7e504c9e
SHA1 d52b47211733578c9e82f402d726aac886518297
SHA512 aca328412140b6b05cc28bbea8e9c9f1e0d619909c36b52f6bc9bc356e5769fddde7cb66a4a8b04972f3f9f5b53ca86d4699e7cd980f1ab70e6a643811bc3daa
SSDEEP 786432:d0LoCOn+26s4urYDNulLBiuCZ/QI7oaTjg2wfcDNzCeJ19xlJYWcBb9K:dMoCm/6XwCT89K
TLSH
T1D0F7BE02B3E505A3D5A792348A9B0203E372B4635734DBDB719C43582FABBE45A7F760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Clipboard Data 1 TTPs 64 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3640	powershell.exe
1948	powershell.exe
1084	powershell.exe
2656	cmd.exe
4944	cmd.exe
4212	powershell.exe
4528	cmd.exe
4656	cmd.exe
200	powershell.exe
2956	cmd.exe
2636	powershell.exe
4280	powershell.exe
1412	powershell.exe
3144	powershell.exe
1296	powershell.exe
2776	powershell.exe
2420	cmd.exe
2932	powershell.exe
2900	powershell.exe
4700	powershell.exe
3792	cmd.exe
1100	cmd.exe
3408	cmd.exe
3748	cmd.exe
4808	cmd.exe
3192	cmd.exe
3148	cmd.exe
5052	cmd.exe
3252	cmd.exe
4932	powershell.exe
3564	powershell.exe
1960	powershell.exe
1796	powershell.exe
1716	cmd.exe
2056	powershell.exe
4520	powershell.exe
5060	powershell.exe
4592	powershell.exe
5804	cmd.exe
4348	powershell.exe
2336	powershell.exe
364	powershell.exe
2072	cmd.exe
560	cmd.exe
5584	cmd.exe
2380	cmd.exe
5460	cmd.exe
4228	cmd.exe
2948	cmd.exe
3772	cmd.exe
2040	cmd.exe
4280	powershell.exe
5248	cmd.exe
2660	cmd.exe
5080	powershell.exe
4880	cmd.exe
3032	cmd.exe
1592	cmd.exe
4212	powershell.exe
5956	powershell.exe
2588	cmd.exe
796	cmd.exe
1212	cmd.exe
2892	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe

Loads dropped DLL 3 IoCs

pid	Process
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
7	ipinfo.io

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1636	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe
5280	powershell.exe
4592	powershell.exe
2052	powershell.exe
1808	powershell.exe
1764	powershell.exe
4484	powershell.exe
5260	powershell.exe
2244	powershell.exe
480	powershell.exe
4792	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6076	cmd.exe
1432	cmd.exe
5124	cmd.exe
2544	cmd.exe
268	cmd.exe
2008	cmd.exe
5984	cmd.exe
5148	cmd.exe
1868	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3544	ping.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4788	NETSTAT.EXE
5712	ipconfig.exe
2300	NETSTAT.EXE
5744	NETSTAT.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3544	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
1948	powershell.exe
1948	powershell.exe
3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
6096	powershell.exe
6096	powershell.exe
2052	powershell.exe
2052	powershell.exe
5280	powershell.exe
5280	powershell.exe
5260	powershell.exe
5260	powershell.exe
1808	powershell.exe
1808	powershell.exe
6096	powershell.exe
480	powershell.exe
480	powershell.exe
2244	powershell.exe
2244	powershell.exe
3180	powershell.exe
3180	powershell.exe
1764	powershell.exe
1764	powershell.exe
4484	powershell.exe
4484	powershell.exe
4592	powershell.exe
4592	powershell.exe
5260	powershell.exe
2052	powershell.exe
5280	powershell.exe
4484	powershell.exe
1808	powershell.exe
480	powershell.exe
2244	powershell.exe
3180	powershell.exe
1764	powershell.exe
4592	powershell.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
1960	powershell.exe
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	5744	NETSTAT.EXE
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 268	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	91
PID 268 wrote to memory of 372	268	cmd.exe	93
PID 3700 wrote to memory of 2924	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	94
PID 2924 wrote to memory of 1948	2924	cmd.exe	95
PID 3700 wrote to memory of 6076	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	96
PID 6076 wrote to memory of 2300	6076	cmd.exe	98
PID 2300 wrote to memory of 2008	2300	NETSTAT.EXE	99
PID 2008 wrote to memory of 3688	2008	cmd.exe	100
PID 3700 wrote to memory of 5984	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	101
PID 3700 wrote to memory of 1808	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	102
PID 3700 wrote to memory of 3180	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	103
PID 3700 wrote to memory of 2052	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	104
PID 3700 wrote to memory of 2244	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	105
PID 3700 wrote to memory of 4592	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	106
PID 3700 wrote to memory of 5260	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	107
PID 3700 wrote to memory of 4484	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	108
PID 3700 wrote to memory of 5280	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	109
PID 3700 wrote to memory of 1764	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	110
PID 3700 wrote to memory of 3544	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	137
PID 3700 wrote to memory of 480	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	113
PID 3700 wrote to memory of 1896	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	114
PID 1896 wrote to memory of 6096	1896	cmd.exe	126
PID 5984 wrote to memory of 5744	5984	cmd.exe	127
PID 3700 wrote to memory of 5336	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	128
PID 5336 wrote to memory of 3564	5336	cmd.exe	129
PID 1764 wrote to memory of 5028	1764	powershell.exe	130
PID 3700 wrote to memory of 2380	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	134
PID 2380 wrote to memory of 4264	2380	cmd.exe	135
PID 1808 wrote to memory of 5552	1808	powershell.exe	136
PID 5552 wrote to memory of 3544	5552	query.exe	137
PID 3700 wrote to memory of 3864	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	139
PID 3864 wrote to memory of 4700	3864	cmd.exe	140
PID 3700 wrote to memory of 4952	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	141
PID 4952 wrote to memory of 3420	4952	cmd.exe	142
PID 3700 wrote to memory of 4808	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	143
PID 4808 wrote to memory of 4592	4808	cmd.exe	164
PID 3700 wrote to memory of 5148	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	147
PID 5148 wrote to memory of 4788	5148	cmd.exe	149
PID 4788 wrote to memory of 1868	4788	NETSTAT.EXE	150
PID 1868 wrote to memory of 5856	1868	cmd.exe	151
PID 3700 wrote to memory of 4792	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	152
PID 3700 wrote to memory of 1064	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	154
PID 1064 wrote to memory of 3220	1064	cmd.exe	155
PID 3700 wrote to memory of 1432	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	156
PID 1432 wrote to memory of 4244	1432	cmd.exe	158
PID 3700 wrote to memory of 5124	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	159
PID 5124 wrote to memory of 5712	5124	cmd.exe	161
PID 3700 wrote to memory of 796	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	162
PID 796 wrote to memory of 1960	796	cmd.exe	163
PID 3700 wrote to memory of 4592	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	164
PID 4592 wrote to memory of 2548	4592	cmd.exe	165
PID 3700 wrote to memory of 2544	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	166
PID 2544 wrote to memory of 1636	2544	cmd.exe	167
PID 3700 wrote to memory of 2660	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	168
PID 2660 wrote to memory of 4748	2660	cmd.exe	169
PID 3700 wrote to memory of 3684	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	170
PID 3684 wrote to memory of 200	3684	cmd.exe	171
PID 3700 wrote to memory of 3264	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	172
PID 3264 wrote to memory of 1084	3264	cmd.exe	173
PID 3700 wrote to memory of 5804	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	174
PID 5804 wrote to memory of 4132	5804	cmd.exe	175
PID 3700 wrote to memory of 716	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	176
PID 716 wrote to memory of 3156	716	cmd.exe	177
PID 3700 wrote to memory of 5616	3700	2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d7f90fd7e850d4df015d62e7e504c9e_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -nao"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\system32\NETSTAT.EXE
    netstat -nao
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\query.exe
    "C:\Windows\system32\query.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\system32\quser.exe
      "C:\Windows\system32\quser.exe"
      4⤵
      PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show networks mode=Bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5028
- C:\Windows\system32\ping.exe
  ping 8.8.8.8 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    - Suspicious use of AdjustPrivilegeToken
    PID:364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:5248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:1100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  - Clipboard Data
  PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Clipboard Data
    PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1392

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5228

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3396

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 2fde68301bb6169cd3adc080e3200576d9f10fbc509b0915acfde17f5a1084ab
MD5 f20e7443cb2df04a90d2e4cd9e9cd621
SHA1 535ea8d245ff10bc4db8fca061c8dcc9f1cf0bb6
SHA512 3746dfd01136fd7d8a1f7111b135f13923500de35ed2aee32ac459e2de1ee50874e15b9332c0c4309f8453733472a6565885af482e82d65c56be1a8caea75c33
TLSH
T128316833B3DC8BA1C88A417E10DA9C5031B7C7C790AECEDB6B5CD564A02F697CE65560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 9755b1e9f88f8306c157dd6385673f972e974cb6cb353821ae00cc72f5e6ba9b
MD5 95a17cf701203572bbc983b573ba23f8
SHA1 ad38aca703c2a852e9149c7b0972e0c6a90218a4
SHA512 796d9127bf828cbe356562c6a2336a713aa063ee1b657819ef2b93aba9cb28e90436ad476127870045e9ca924432e4b027c1f1e7761cc08cf56a43fbe26245d9
TLSH
T14D316833B3DC8BA1D88A417E10D99C6031B7C7C790AECEDB6B9CD564A02F697CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 32cb9de8f353647667b7f924bb30db77f8f0fb89be6c64bcdafe6ae2081e4f65
MD5 2383e5b8258b4bd2bad92d11b4ee415a
SHA1 dd6c9b285acbb1a9edb3b33e7ca18777dabe3934
SHA512 2155a637f6b103621880dee3bed745943dd0c1bea39e86852e3df7d1639b8b64346e5bdd03b6acef332ad8ee2b9f2caf0eb675a5c0ba70393e54b77a40440739
TLSH
T1D8318623B3D887A0C899517E20D99C5032BB83CB809ECEDB2B8CD125A42F697CE61520
MD5 SHA1 SHA512 TLSH

Submit Download