meshagent | 10f75b9ee94260c94591ff77f665fee033e2ee1dfc1680453aeacbb89c3ac474

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 17 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5a8-14.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-41-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4476-45-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6040-46-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-63-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5908-64-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-108-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-126-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-132-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-147-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3076-151-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-158-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-167-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-172-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-191-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-204-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2620-213-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing many IR and analysis tools 17 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5a8-14.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-41-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4476-45-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/6040-46-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-63-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/5908-64-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-108-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-126-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-132-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-147-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3076-151-0x00007FF6F48B0000-0x00007FF6F4E71000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-158-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-167-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-172-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-191-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-204-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2620-213-0x00007FF6580E0000-0x00007FF6586A1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1308	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
4476	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
6040	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5908	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
3076	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4652	tasklist.exe
4308	tasklist.exe
2548	tasklist.exe
2020	tasklist.exe
2004	tasklist.exe
1988	tasklist.exe
2808	tasklist.exe
3192	tasklist.exe
5536	tasklist.exe
5052	tasklist.exe
940	tasklist.exe
5284	tasklist.exe
5780	tasklist.exe
2252	tasklist.exe
5100	tasklist.exe
1296	tasklist.exe
3176	tasklist.exe
580	tasklist.exe
2492	tasklist.exe
4916	tasklist.exe
4528	tasklist.exe
2872	tasklist.exe
5688	tasklist.exe
3448	tasklist.exe
5528	tasklist.exe
4968	tasklist.exe
1896	tasklist.exe
3360	tasklist.exe
3644	tasklist.exe
3644	tasklist.exe
4228	tasklist.exe
2896	tasklist.exe
5360	tasklist.exe
2680	tasklist.exe
4820	tasklist.exe
5220	tasklist.exe
2840	tasklist.exe
2832	tasklist.exe
4888	tasklist.exe
920	tasklist.exe
5936	tasklist.exe
3852	tasklist.exe
2512	tasklist.exe
6008	tasklist.exe
4392	tasklist.exe
1940	tasklist.exe
5624	tasklist.exe
5680	tasklist.exe
2360	tasklist.exe
4776	tasklist.exe
3448	tasklist.exe
5536	tasklist.exe
1896	tasklist.exe
4376	tasklist.exe
4676	tasklist.exe
5688	tasklist.exe
4948	tasklist.exe
2644	tasklist.exe
2548	tasklist.exe
3548	tasklist.exe
5496	tasklist.exe
4204	tasklist.exe
2420	tasklist.exe
5576	tasklist.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3960	sc.exe
4368	sc.exe
1876	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5276	cmd.exe
5616	cmd.exe
1560	cmd.exe
1728	cmd.exe
256	cmd.exe
2484	cmd.exe
5912	cmd.exe
5396	cmd.exe
2576	cmd.exe
4668	cmd.exe
3452	cmd.exe
5724	cmd.exe
4420	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
756	netstat.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
2676	timeout.exe
3096	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3940	ipconfig.exe
756	netstat.exe

Modifies Control Panel 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\Cursors\\aero_arrow_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_up_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\Wait = "C:\\Windows\\Cursors\\aero_busy_xl.ani"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\NWPen = "C:\\Windows\\Cursors\\aero_pen_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\SizeNS = "C:\\Windows\\Cursors\\aero_ns_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\SizeWE = "C:\\Windows\\Cursors\\aero_ew_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\SizeNESW = "C:\\Windows\\Cursors\\aero_nesw_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\SizeAll = "C:\\Windows\\Cursors\\aero_move_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\No = "C:\\Windows\\Cursors\\aero_unavail_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\SizeNWSE = "C:\\Windows\\Cursors\\aero_nwse_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\UpArrow = "C:\\Windows\\Cursors\\aero_up_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Cursors\Hand = "C:\\Windows\\Cursors\\aero_link_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\htafile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	reg.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

pid	Process
3340	reg.exe
2388	reg.exe
4876	reg.exe
1928	reg.exe
4472	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2780	wmic.exe
2780	wmic.exe
2780	wmic.exe
2780	wmic.exe
3012	wmic.exe
3012	wmic.exe
3012	wmic.exe
3012	wmic.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
4896	wmic.exe
4896	wmic.exe
4896	wmic.exe
4896	wmic.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2780	wmic.exe
Token: SeSecurityPrivilege	2780	wmic.exe
Token: SeTakeOwnershipPrivilege	2780	wmic.exe
Token: SeLoadDriverPrivilege	2780	wmic.exe
Token: SeSystemProfilePrivilege	2780	wmic.exe
Token: SeSystemtimePrivilege	2780	wmic.exe
Token: SeProfSingleProcessPrivilege	2780	wmic.exe
Token: SeIncBasePriorityPrivilege	2780	wmic.exe
Token: SeCreatePagefilePrivilege	2780	wmic.exe
Token: SeBackupPrivilege	2780	wmic.exe
Token: SeRestorePrivilege	2780	wmic.exe
Token: SeShutdownPrivilege	2780	wmic.exe
Token: SeDebugPrivilege	2780	wmic.exe
Token: SeSystemEnvironmentPrivilege	2780	wmic.exe
Token: SeRemoteShutdownPrivilege	2780	wmic.exe
Token: SeUndockPrivilege	2780	wmic.exe
Token: SeManageVolumePrivilege	2780	wmic.exe
Token: 33	2780	wmic.exe
Token: 34	2780	wmic.exe
Token: 35	2780	wmic.exe
Token: 36	2780	wmic.exe
Token: SeIncreaseQuotaPrivilege	2780	wmic.exe
Token: SeSecurityPrivilege	2780	wmic.exe
Token: SeTakeOwnershipPrivilege	2780	wmic.exe
Token: SeLoadDriverPrivilege	2780	wmic.exe
Token: SeSystemProfilePrivilege	2780	wmic.exe
Token: SeSystemtimePrivilege	2780	wmic.exe
Token: SeProfSingleProcessPrivilege	2780	wmic.exe
Token: SeIncBasePriorityPrivilege	2780	wmic.exe
Token: SeCreatePagefilePrivilege	2780	wmic.exe
Token: SeBackupPrivilege	2780	wmic.exe
Token: SeRestorePrivilege	2780	wmic.exe
Token: SeShutdownPrivilege	2780	wmic.exe
Token: SeDebugPrivilege	2780	wmic.exe
Token: SeSystemEnvironmentPrivilege	2780	wmic.exe
Token: SeRemoteShutdownPrivilege	2780	wmic.exe
Token: SeUndockPrivilege	2780	wmic.exe
Token: SeManageVolumePrivilege	2780	wmic.exe
Token: 33	2780	wmic.exe
Token: 34	2780	wmic.exe
Token: 35	2780	wmic.exe
Token: 36	2780	wmic.exe
Token: SeIncreaseQuotaPrivilege	3012	wmic.exe
Token: SeSecurityPrivilege	3012	wmic.exe
Token: SeTakeOwnershipPrivilege	3012	wmic.exe
Token: SeLoadDriverPrivilege	3012	wmic.exe
Token: SeSystemProfilePrivilege	3012	wmic.exe
Token: SeSystemtimePrivilege	3012	wmic.exe
Token: SeProfSingleProcessPrivilege	3012	wmic.exe
Token: SeIncBasePriorityPrivilege	3012	wmic.exe
Token: SeCreatePagefilePrivilege	3012	wmic.exe
Token: SeBackupPrivilege	3012	wmic.exe
Token: SeRestorePrivilege	3012	wmic.exe
Token: SeShutdownPrivilege	3012	wmic.exe
Token: SeDebugPrivilege	3012	wmic.exe
Token: SeSystemEnvironmentPrivilege	3012	wmic.exe
Token: SeRemoteShutdownPrivilege	3012	wmic.exe
Token: SeUndockPrivilege	3012	wmic.exe
Token: SeManageVolumePrivilege	3012	wmic.exe
Token: 33	3012	wmic.exe
Token: 34	3012	wmic.exe
Token: 35	3012	wmic.exe
Token: 36	3012	wmic.exe
Token: SeIncreaseQuotaPrivilege	3012	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3360	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	91
PID 2620 wrote to memory of 4764	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	93
PID 2620 wrote to memory of 4340	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	95
PID 2620 wrote to memory of 4788	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	97
PID 2620 wrote to memory of 1492	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	99
PID 2620 wrote to memory of 124	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	101
PID 2620 wrote to memory of 2388	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	103
PID 2620 wrote to memory of 3096	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	105
PID 2620 wrote to memory of 4876	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	107
PID 2620 wrote to memory of 1928	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	109
PID 2620 wrote to memory of 2484	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	111
PID 2484 wrote to memory of 940	2484	cmd.exe	113
PID 2620 wrote to memory of 1888	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	114
PID 2620 wrote to memory of 4440	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	116
PID 2620 wrote to memory of 2780	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	118
PID 2620 wrote to memory of 3012	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	121
PID 2620 wrote to memory of 4420	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	124
PID 2620 wrote to memory of 5912	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	126
PID 2620 wrote to memory of 5276	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	128
PID 4420 wrote to memory of 4408	4420	cmd.exe	130
PID 4420 wrote to memory of 4140	4420	cmd.exe	131
PID 5276 wrote to memory of 3940	5276	cmd.exe	132
PID 4420 wrote to memory of 6040	4420	cmd.exe	133
PID 4420 wrote to memory of 2676	4420	cmd.exe	134
PID 2620 wrote to memory of 5616	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	137
PID 5616 wrote to memory of 2360	5616	cmd.exe	139
PID 2620 wrote to memory of 5396	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	141
PID 5396 wrote to memory of 2972	5396	cmd.exe	143
PID 2620 wrote to memory of 2576	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	144
PID 2576 wrote to memory of 2524	2576	cmd.exe	146
PID 2620 wrote to memory of 1560	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	147
PID 1560 wrote to memory of 2148	1560	cmd.exe	149
PID 4420 wrote to memory of 5924	4420	cmd.exe	150
PID 4420 wrote to memory of 4876	4420	cmd.exe	151
PID 4420 wrote to memory of 3076	4420	cmd.exe	152
PID 4420 wrote to memory of 3096	4420	cmd.exe	153
PID 2620 wrote to memory of 4384	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	154
PID 2620 wrote to memory of 4908	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	156
PID 2620 wrote to memory of 1876	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	158
PID 2620 wrote to memory of 4668	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	160
PID 4668 wrote to memory of 1296	4668	cmd.exe	162
PID 2620 wrote to memory of 5836	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	163
PID 2620 wrote to memory of 4472	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	165
PID 2620 wrote to memory of 3340	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	167
PID 2620 wrote to memory of 3452	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	169
PID 3452 wrote to memory of 3140	3452	cmd.exe	171
PID 2620 wrote to memory of 4896	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	172
PID 2620 wrote to memory of 4500	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	174
PID 2620 wrote to memory of 1728	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	176
PID 2620 wrote to memory of 3960	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	177
PID 1728 wrote to memory of 4916	1728	cmd.exe	181
PID 1728 wrote to memory of 3192	1728	cmd.exe	182
PID 1728 wrote to memory of 2952	1728	cmd.exe	185
PID 1728 wrote to memory of 2920	1728	cmd.exe	186
PID 1728 wrote to memory of 1596	1728	cmd.exe	187
PID 2620 wrote to memory of 2644	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	188
PID 1728 wrote to memory of 700	1728	cmd.exe	190
PID 2620 wrote to memory of 712	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	191
PID 2620 wrote to memory of 1308	2620	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	193
PID 1728 wrote to memory of 6136	1728	cmd.exe	195
PID 1728 wrote to memory of 4448	1728	cmd.exe	196
PID 1728 wrote to memory of 4176	1728	cmd.exe	197
PID 1728 wrote to memory of 4652	1728	cmd.exe	198
PID 1728 wrote to memory of 3956	1728	cmd.exe	199

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
1⤵
- Windows security bypass
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2620
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  "reg" add HKLM\Software\Classes\htafile\DefaultIcon /ve /t REG_SZ /d "C:\Program Files\Internet Explorer\iexplore.exe,0" /f
  2⤵
  - Modifies registry class
  - Modifies registry key
  PID:2388
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /TN MicrosoftWindowsRuntimeBroker /F
  2⤵
  PID:3096
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:4876
- C:\Windows\system32\reg.exe
  "reg" delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:940
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /XML C:\Users\Admin\AppData\Local\Temp\WinRtBrk_2620.tmp /TN 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1888
- C:\Windows\system32\schtasks.exe
  "schtasks" /Change /TN 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /ENABLE
  2⤵
  PID:4440
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" get ProcessId
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\SvcCache\w.cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:4408
- - C:\Windows\system32\find.exe
    find /i "2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Executes dropped EXE
    PID:6040
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:5924
- - C:\Windows\system32\find.exe
    find /i "2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Executes dropped EXE
    PID:3076
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3096
- C:\Windows\system32\cmd.exe
  "cmd" /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5912
- C:\Windows\system32\cmd.exe
  "cmd" /c ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:2148
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:1876
- C:\Windows\system32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:1296
- C:\Windows\System32\schtasks.exe
  "schtasks" /Delete /TN MicrosoftWindowsRuntimeBroker /F
  2⤵
  PID:5836
- C:\Windows\System32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:4472
- C:\Windows\System32\reg.exe
  "reg" delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:3340
- C:\Windows\System32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:3140
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" get ProcessId
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Windows\System32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\SvcCache\w.cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4916
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3192
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2952
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:700
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:6136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4448
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4176
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4652
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3956
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4232
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5580
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1396
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4072
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1944
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3176
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1156
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4568
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3852
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3448
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1588
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1896
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1176
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4164
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5256
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1872
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1848
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4244
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4828
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5064
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5576
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2252
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5536
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4820
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4908
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3472
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4332
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2248
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3772
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:572
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1608
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3688
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2436
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:580
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5216
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4460
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2340
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2492
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5688
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5960
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3412
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5496
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3960
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5508
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1936
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4876
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1816
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2604
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5236
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:368
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:6008
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5652
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4368
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4204
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4320
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5936
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1940
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5648
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4996
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2244
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5672
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5772
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5244
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2784
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1352
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1656
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4500
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1284
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4916
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4720
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3960
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4648
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3520
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:940
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1888
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2832
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2148
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4776
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4588
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5832
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2020
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2872
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1608
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4736
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4228
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4752
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2896
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4968
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2272
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5836
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3448
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5688
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3640
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5368
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1848
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5576
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2420
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1936
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:904
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3180
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2172
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3504
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4384
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2132
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:236
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4332
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4616
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1944
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5004
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3836
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3284
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4748
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:6012
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4572
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5244
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:6088
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:476
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4388
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1172
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1656
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5284
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:6032
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5576
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3584
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3952
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:932
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4652
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3472
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4472
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2148
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5100
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2840
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2580
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4936
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2364
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1144
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5128
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2004
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2652
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5420
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5260
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4744
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1048
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2792
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4968
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2784
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5780
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5096
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4408
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2524
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5528
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3584
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5664
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5732
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5536
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5236
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2832
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5560
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3804
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2864
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1060
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5008
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:6048
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5340
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2808
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5844
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5108
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2388
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1896
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5416
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4888
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3652
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4828
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2880
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1888
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2748
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4812
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4384
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5000
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5568
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5004
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4556
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2968
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4752
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1048
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4716
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5936
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:5244
- C:\Windows\System32\sc.exe
  "sc" config TermService start= auto
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\System32\reg.exe
  "reg" add "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 0 /f
  2⤵
  PID:2644
- C:\Windows\System32\reg.exe
  "reg" add "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
  2⤵
  PID:712
- C:\Windows\System32\netsh.exe
  "netsh" advfirewall firewall set rule "name=Remote Desktop - User Mode (TCP-In)" new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1308
- C:\Windows\System32\cmd.exe
  "cmd" /c "net stop TermService /y & net start TermService"
  2⤵
  - Executes a command shell one-liner
  PID:5724
- - C:\Windows\system32\net.exe
    net stop TermService /y
    3⤵
    PID:5512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop TermService /y
      4⤵
      PID:5404
- - C:\Windows\system32\net.exe
    net start TermService
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start TermService
      4⤵
      PID:920
- C:\Windows\System32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  PID:256
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:2364
- C:\Windows\System32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\System32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:1944
- C:\Windows\System32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4712
- C:\Windows\System32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:4924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4568
- C:\Windows\System32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:4356
- C:\Windows\System32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4608
- C:\Windows\System32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\ma_4.exe
  "C:\Users\Admin\AppData\Local\Temp\ma_4.exe" -fulluninstall
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\ma_4.exe
  "C:\Users\Admin\AppData\Local\Temp\ma_4.exe" -fullinstall
  2⤵
  PID:4164
- C:\Windows\System32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:1876
- C:\Windows\System32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq MeshAgent.exe" /FO CSV /NH
  2⤵
  PID:4812
- C:\Windows\System32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:756

C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1⤵
- Executes dropped EXE
PID:4476

C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
"C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
1⤵
- Executes dropped EXE
PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:1592

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4980
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  PID:4404

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion